CVE-2019-25317: Kimai 2- persistent cross-site scripting (XSS)
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/kimai/kimaito a version that resolves this vulnerability.Fixed in 1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25317?
CVE-2019-25317 is classified as a medium-severity vulnerability due to its potential for persistent cross-site scripting attacks.
How do I fix CVE-2019-25317?
To mitigate CVE-2019-25317, update Kimai 2 to the latest version that addresses the XSS vulnerability.
What type of vulnerability is CVE-2019-25317?
CVE-2019-25317 is a persistent cross-site scripting (XSS) vulnerability.
What impact can CVE-2019-25317 have on users?
CVE-2019-25317 allows attackers to inject malicious scripts that can execute arbitrary JavaScript when users view compromised timesheet descriptions.
In which software is CVE-2019-25317 found?
CVE-2019-25317 affects the Kimai 2 application.