Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2021-3985
Good to know:
Date: December 1, 2021
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Language: PHP
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79Top Fix
Upgrade Version
Upgrade to version kevinpapst/kimai2 - dev-budgets;kevinpapst/kimai2 - dev-last-minute-1.13;kevinpapst/kimai2 - dev-pdf-invoice;kevinpapst/kimai2 - dev-user-validator;kevinpapst/kimai2 - 1.16.1.x-dev;kevinpapst/kimai2 - dev-configuration;kevinpapst/kimai2 - dev-release-1.15.3;kevinpapst/kimai2 - dev-user-js-api;kevinpapst/kimai2 - dev-fixes-1.12;kevinpapst/kimai2 - 1.14.4.x-dev;kevinpapst/kimai2 - dev-order-hourly-rate;kevinpapst/kimai2 - dev-locales;kevinpapst/kimai2 - dev-quick-entry-permission;kevinpapst/kimai2 - dev-export-date;kevinpapst/kimai2 - dev-feat/move-docker-into-main-repo;kevinpapst/kimai2 - dev-working-times;kevinpapst/kimai2 - 1.15.1.x-dev;kevinpapst/kimai2 - dev-project-dropdown;kevinpapst/kimai2 - dev-fix-budget;kevinpapst/kimai2 - dev-invoice-budget;kevinpapst/kimai2 - 1.x-dev;kevinpapst/kimai2 - dev-doctrine-deprecations;kevinpapst/kimai2 - dev-validate-timezone;kevinpapst/kimai2 - 1.16.3;kevinpapst/kimai2 - dev-negative-duration;kevinpapst/kimai2 - dev-post-1.15;kevinpapst/kimai2 - dev-reports;kevinpapst/kimai2 - dev-timesheet-to-invoice;kevinpapst/kimai2 - dev-budget-graph;kevinpapst/kimai2 - dev-release-1.15.6;kevinpapst/kimai2 - dev-api-enhancements;kevinpapst/kimai2 - dev-privilege-escalation;kevinpapst/kimai2 - dev-php-8.3;kevinpapst/kimai2 - dev-release-1.16;kevinpapst/kimai2 - dev-invoice-permissions;kevinpapst/kimai2 - dev-escape-calendar;kevinpapst/kimai2 - dev-reporting-datatypes;kevinpapst/kimai2 - dev-api-times;kevinpapst/kimai2 - no_fix;kevinpapst/kimai2 - dev-better-invoices;kevinpapst/kimai2 - dev-edit-username;kevinpapst/kimai2 - dev-cache-approvals;kevinpapst/kimai2 - dev-team-filter;kevinpapst/kimai2 - dev-export-budget;kevinpapst/kimai2 - dev-activity-events;kevinpapst/kimai2 - dev-dashboard-permissions;kevinpapst/kimai2 - dev-detail-event;kevinpapst/kimai2 - dev-fix-rounding;kevinpapst/kimai2 - dev-calendar-sum;kimai/kimai - 1.2.2;kimai/kimai - 1.16.3;kimai/kimai - 1.x-dev;kimai/kimai - 0.9.3;kimai/kimai - 1.3.1;kimai/kimai - dev-fixes-1.12
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | REQUIRED |
| Scope (S): | CHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | MEDIUM |
| Authentication (AU): | SINGLE |
| Confidentiality (C): | PARTIAL |
| Integrity (I): | PARTIAL |
| Availability (A): | PARTIAL |
| Additional information: |