Skip to content
Fencer Intel
high —

GHSA-c39w-3pjx-qc7m json

Leantime allows Stored Cross-Site Scripting (XSS)

published last yr. modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Description Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key.

### Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.

Patch / fix

  • packagist leantime/leantime 3.3

Is GHSA-c39w-3pjx-qc7m in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist leantime/leantime
<3.3
3.3

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.