Publish Advisories

GHSA-52xf-h226-pfgx
GHSA-63cr-xg3f-8jvr
GHSA-99r5-84gr-59f6
GHSA-h6w8-27ph-c385
GHSA-mg4c-884j-pcq9

advisories/github-reviewed/2025/02/GHSA-52xf-h226-pfgx/GHSA-52xf-h226-pfgx.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-52xf-h226-pfgx",
+  "modified": "2025-02-21T22:15:26Z",
+  "published": "2025-02-21T22:15:26Z",
+  "aliases": [],
+  "summary": "Leantime allows Refelected Cross-Site Scripting (XSS)",
+  "details": "### Summary\nThe vulnerability in Leantime's \"overdue\" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively.\n\n### Impact\nThis XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and potentially executing unauthorized actions on behalf of users. Exploitation could lead to account takeover, data theft, and unauthorized access to sensitive information, posing a significant risk to user privacy, data integrity, and system security.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-52xf-h226-pfgx"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:15:26Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/02/GHSA-63cr-xg3f-8jvr/GHSA-63cr-xg3f-8jvr.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-63cr-xg3f-8jvr",
+  "modified": "2025-02-21T22:15:52Z",
+  "published": "2025-02-21T22:15:52Z",
+  "aliases": [],
+  "summary": "Leantime allows Stored Cross-Site Scripting (XSS)",
+  "details": "### Summary\nStored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. \n\n### Details\nA Stored Cross-Site Scripting (XSS) vulnerability was found that could potentially compromise user data and pose a significant security risk to the platform.\n\n### PoC\n\n- Create a project\n- Navigate to project\n- Visit to the integration\n- Add malicious payload inside the webhook and save it.\n- Notice the alert dialogue indicating successful execution of the XSS payload.\n```\n'';!--\" onfocus=alert(0) autofocus=\"\"  onload=alert(3);=\"&{(alert(1))}\" |=\"\" mufazmi\"=\"\n```\n```\n'';!--\" onfocus=alert(0) autofocus=\"\"  onload=alert(3);=>>\"&{(alert(1))}\" |=\"\">> mufazmi\"=\">>\n```\n### POC\nhttps://youtu.be/kqKFgsOqstg\n\n\n### Impact\nThis XSS vulnerability allows an attacker to execute malicious scripts in the context of a victim's browser when they click on a specially crafted link. This could lead to various malicious activities, including session hijacking, stealing sensitive information such as cookies or login credentials, and potentially compromising the entire platform's security.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "3.1.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-63cr-xg3f-8jvr"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    },
+    {
+      "type": "WEB",
+      "url": "https://youtu.be/kqKFgsOqstg"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:15:52Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/02/GHSA-99r5-84gr-59f6/GHSA-99r5-84gr-59f6.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-99r5-84gr-59f6",
+  "modified": "2025-02-21T22:14:50Z",
+  "published": "2025-02-21T22:14:50Z",
+  "aliases": [],
+  "summary": "Leantime has Host Header Injection Vulnerability ",
+  "details": "### Summary\nA host header injection vulnerability has been identified in the user details viewing functionality of the system. This vulnerability allows an attacker to manipulate the host header in HTTP requests, thereby gaining unauthorized access to view details of other users.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-99r5-84gr-59f6"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:14:50Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/02/GHSA-h6w8-27ph-c385/GHSA-h6w8-27ph-c385.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h6w8-27ph-c385",
+  "modified": "2025-02-21T22:15:19Z",
+  "published": "2025-02-21T22:15:19Z",
+  "aliases": [],
+  "summary": " Leantime has Insufficiently Protected Credentials",
+  "details": "Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore.\n\nAdditional Information:\n\n    1.The issue was identified during routine security testing.\n    2.This vulnerability poses a significant risk to user privacy and data security.\n    3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-h6w8-27ph-c385"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-522"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:15:19Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/02/GHSA-mg4c-884j-pcq9/GHSA-mg4c-884j-pcq9.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mg4c-884j-pcq9",
+  "modified": "2025-02-21T22:14:58Z",
+  "published": "2025-02-21T22:14:58Z",
+  "aliases": [],
+  "summary": "Leantime allows Stored Cross-Site Scripting (XSS)",
+  "details": "STORED XSS +OPEN REDIRECTION in SVG uploads\nVulnerable url:https://hack.leantime.io/projects/showProject/3",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-mg4c-884j-pcq9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/commit/d8b1099b0629da64ad30a1c4daee104fadc6c227"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:14:58Z",
+    "nvd_published_at": null
+  }
+}