Description (CNA)
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kimai / Kimai | affected 1.30.10 |
CWE
CWE-1275
References
- https://www.exploit-db.com/exploits/51278
- https://github.com/kimai/kimai/releases/tag/1.30.10
- https://www.vulncheck.com/advisories/kimai-samesite-cookie-vulnerability-session-hijacking
ADP enrichment
No English description supplied.
No references supplied.