Publish Advisories

GHSA-92xh-6x7v-4rmq
GHSA-c39w-3pjx-qc7m
GHSA-v4q9-437p-mhpg

advisories/github-reviewed/2025/02/GHSA-92xh-6x7v-4rmq/GHSA-92xh-6x7v-4rmq.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-92xh-6x7v-4rmq",
+  "modified": "2025-02-21T22:48:41Z",
+  "published": "2025-02-21T22:48:41Z",
+  "aliases": [],
+  "summary": "Leantime allows Cross-Site Request Forgery (CSRF)",
+  "details": "**CSRF**\n### Summary\nA cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing. \n\n### Impact\nWhile the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-92xh-6x7v-4rmq"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:48:41Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/02/GHSA-c39w-3pjx-qc7m/GHSA-c39w-3pjx-qc7m.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c39w-3pjx-qc7m",
+  "modified": "2025-02-21T22:48:46Z",
+  "published": "2025-02-21T22:48:46Z",
+  "aliases": [],
+  "summary": "Leantime allows Stored Cross-Site Scripting (XSS)",
+  "details": "### Description\nLeantime allows stored cross-site scripting (XSS) in the API key name while generating the API key.\n\n### Impact\nAny low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-c39w-3pjx-qc7m"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:48:46Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/02/GHSA-v4q9-437p-mhpg/GHSA-v4q9-437p-mhpg.json

@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-v4q9-437p-mhpg",
+  "modified": "2025-02-21T22:48:26Z",
+  "published": "2025-02-21T22:48:26Z",
+  "aliases": [],
+  "summary": "Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)",
+  "details": "### Summary\nA cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET[\"id\"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "leantime/leantime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-v4q9-437p-mhpg"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Leantime/leantime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79",
+      "CWE-89"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T22:48:26Z",
+    "nvd_published_at": null
+  }
+}