Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.5%
exploitation probability
0.5%top 60% of all CVEs
observed exploitation
nono source reports it
In short
Kimai 1.30.10 fails to properly protect session cookies, allowing attackers to steal them through a trick that makes victims run malicious code. This lets attackers hijack user sessions and impersonate legitimate users.
Technical detail
The application lacks proper SameSite cookie attributes, enabling cross-site request forgery (CSRF) attacks where victims are lured to execute crafted PHP scripts that capture session cookies. An attacker can leverage this to perform unauthorized actions on behalf of authenticated users without additional authentication.
Summary generated and translated by AI from the official description.
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Kimai · Kimai