CVE-2024-27477

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Références

advisory github.com
advisory nvd.nist.gov
web drive.proton.me
web github.com
web github.com
web vicarius.io