Threat Intelligence Database

Leantime version 3.6.2 contains an open redirect vulnerability in its Login controller. This flaw allows unauthenticated attackers to manipulate the redirectUrl POST parameter to redirect authenticated users to arbitrary external websites. The vulnerability bypasses FILTER_SANITIZE_URL validation, enabling attackers to craft malicious login URLs that redirect victims to attacker-controlled sites, potentially facilitating phishing or credential theft.

Leantime version 3.6.2 contains a server-side request forgery (SSRF) and local file inclusion (LFI) vulnerability. Authenticated attackers can exploit this issue by passing unsanitized filenames to the Blueprints::import() method via the JSON-RPC API endpoint. This allows them to read internal resources, including arbitrary files on the server or cloud metadata services, by using crafted filenames with URL wrappers or path traversal sequences.

Leantime version 3.6.2 has a cross-site request forgery (CSRF) vulnerability due to the exclusion of the Laravel VerifyCsrfToken middleware from the global middleware stack. This flaw allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by tricking them into submitting malicious requests. Such actions include creating or deleting projects, modifying settings, and changing permissions. There is no information about a patch or fix currently available.