Description
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kimai | Kimai | 1.30.10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | kimai/kimai | <= 1.30.10 | — | GHSA-cv8h-r7r5-vwj9 |
References
- ExploitDB-51278 exploit
- Kimai 1.30.10 Release Notes product release-notes
- VulnCheck Advisory: Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking third-party-advisory