GHSA-99r5-84gr-59f6

Suggest an improvement
Source
https://github.com/advisories/GHSA-99r5-84gr-59f6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-99r5-84gr-59f6/GHSA-99r5-84gr-59f6.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-99r5-84gr-59f6
Published
2025-02-21T22:14:50Z
Modified
2025-02-21T22:27:24.209412Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Leantime has Host Header Injection Vulnerability
Details

Summary

A host header injection vulnerability has been identified in the user details viewing functionality of the system. This vulnerability allows an attacker to manipulate the host header in HTTP requests, thereby gaining unauthorized access to view details of other users.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-74"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-21T22:14:50Z"
}
References

Affected packages

Packagist / leantime/leantime

Package

Name
leantime/leantime
Purl
pkg:composer/leantime/leantime

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.2

Affected versions

v2.*

v2.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.2.10
v2.2.11
v2.3.0-beta
v2.3.1-beta
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27

2.*

2.4-beta
2.4-beta-7
2.4-beta-8
2.4
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8

3.*

3.0.0-beta
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1