Threat Intelligence Database

Leantime version 3.6.2 contains a server-side request forgery (SSRF) and local file inclusion (LFI) vulnerability. Authenticated attackers can exploit this issue by passing unsanitized filenames to the Blueprints::import() method via the JSON-RPC API endpoint. This allows them to read internal resources, including arbitrary files on the server or cloud metadata services, by using crafted filenames with URL wrappers or path traversal sequences.

Leantime version 3.6.2 has a cross-site request forgery (CSRF) vulnerability due to the exclusion of the Laravel VerifyCsrfToken middleware from the global middleware stack. This flaw allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by tricking them into submitting malicious requests. Such actions include creating or deleting projects, modifying settings, and changing permissions. There is no information about a patch or fix currently available.

Leantime version 3.6.2 contains an open redirect vulnerability in its Login controller. This flaw allows unauthenticated attackers to manipulate the redirectUrl POST parameter to redirect authenticated users to arbitrary external websites. The vulnerability bypasses FILTER_SANITIZE_URL validation, enabling attackers to craft malicious login URLs that redirect victims to attacker-controlled sites, potentially facilitating phishing or credential theft.

A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-27477

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-27476

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-27474

Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-27703