CVE-2024-29200: Kimai API Unauthorized Access to Timesheet Entries
Summary
CVE-2024-29200: Kimai API returns timesheet entries a user should not be authorized to view. Affects kimai/kimai versions < 2.13.0. Fixed in 2.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kimai is an open-source time-tracking software that allows users to track their work hours and manage projects. It provides a user interface (UI) as well as an API for accessing and manipulating timesheet data. The vulnerability in question relates to the API functionality of Kimai.
Vulnerability Detail
The 'view_other_timesheet' permission in Kimai performs differently for the UI and the API. While the UI restricts users to view only timesheet entries for teams they are a part of, the API returns all timesheet entries regardless of team permissions. This means that users with the 'view_other_timesheet' permission can access timesheet entries they are not authorized to view. For example, a user who is not a team leader can still see all timesheets in the API, compromising the confidentiality of timesheet entries.
How To Fix
Minimum fixed version
2.13.0
This is the first release that contains the fix.
composer require kimai/kimai:2.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the patch provided by the Kimai development team.
Conclusion
The vulnerability in the Kimai API allows unauthorized access to timesheet entries. Users with the 'view_other_timesheet' permission can view timesheets they are not supposed to. It is crucial to update to Kimai version 2.13.0 or later to fix this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kimai/kimai →
FAQ
The vulnerability allows users with the 'view_other_timesheet' permission to access timesheet entries they are not authorized to view. This compromises the confidentiality of timesheet data.
No, this vulnerability requires authenticated access to the Kimai API. It cannot be exploited remotely.
There are no known instances of this vulnerability being exploited in the wild.
Yes, the CVSS score for this vulnerability is 6.8, indicating a moderate severity.
Yes, API access is required to exploit this vulnerability. Restricting API access to administrators is not a valid solution as it may hinder legitimate usage, such as using the mobile app.
Related vulnerabilities
Recent vulnerabilities recorded for kimai/kimai.
