CVE-2024-4596: Kimai Session information disclosure
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-263318 is the identifier assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/kimai/kimaito a version that resolves this vulnerability.Fixed in 2.16.0 - Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.16.0Patch VDB-263318
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4596?
CVE-2024-4596 is classified as a problematic vulnerability affecting Kimai versions up to 2.15.0.
How do I fix CVE-2024-4596?
To fix CVE-2024-4596, upgrade Kimai to version 2.16.0 or later.
What type of vulnerability is CVE-2024-4596?
CVE-2024-4596 is an information disclosure vulnerability associated with the Session Handler component.
Can CVE-2024-4596 be exploited remotely?
Yes, CVE-2024-4596 can be exploited remotely due to its nature of information disclosure.
What component of Kimai is affected by CVE-2024-4596?
CVE-2024-4596 affects the Session Handler functionality within Kimai.