CVE-2024-27477: XSS
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27477?
CVE-2024-27477 is classified as a medium severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2024-27477?
To fix CVE-2024-27477, it is recommended to sanitize and validate input in the ticket title field to prevent JavaScript code injection.
What impact does CVE-2024-27477 have on users?
CVE-2024-27477 allows attackers to inject malicious scripts into tickets, which can compromise user data and session integrity.
Is CVE-2024-27477 exploitable without authentication?
Yes, CVE-2024-27477 can be exploited by an attacker with access to the ticket creation and modification functionalities, potentially without authentication.
Which versions of Leantime are affected by CVE-2024-27477?
CVE-2024-27477 affects Leantime version 3.0.6, which contains the vulnerable code.