CVE-2020-5292: Time-based blind injection in Leantime
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and administrators' password hashes, modify data, or drop tables. The unescaped parameter is "searchUsers" when sending a POST request to "/tickets/showKanban" with a valid session. In the code, the parameter is named "users" in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Leantimeto a version that resolves this vulnerability.Fixed in 2.0.15 - Upgrade
Upgrade
Leantimeto a version that resolves this vulnerability.Fixed in 2.1.0 beta 3
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-5292.
What is the severity of CVE-2020-5292?
The severity of CVE-2020-5292 is high.
What is the impact of CVE-2020-5292?
The impact of CVE-2020-5292 is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and administrative information.
How can the vulnerability in Leantime be fixed?
To fix the vulnerability in Leantime, it is recommended to upgrade to versions 2.0.15 or 2.1-beta3, which have addressed the SQL Injection vulnerability.
Where can I find more information about CVE-2020-5292?
More information about CVE-2020-5292 can be found in the following references: - [GitHub Commit](https://github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f) - [GitHub Pull Request](https://github.com/Leantime/leantime/pull/181) - [GitHub Security Advisory](https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp)