CVE-2024-27476 - Vulnerability Details - OpenCVE

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Leantime	Leantime

Configuration 1 [-]

cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY
https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20
https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-10T00:00:00

Updated: 2024-08-02T00:34:52.312Z

Reserved: 2024-02-26T00:00:00

Link: CVE-2024-27476

Vulnrichment

Updated: 2024-07-31T17:47:36.928Z

NVD

Status : Analyzed

Published: 2024-04-10T15:16:04.923

Modified: 2025-04-08T15:22:00.250

Link: CVE-2024-27476

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-27476", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T00:34:52.312Z", "dateReserved": "2024-02-26T00:00:00", "datePublished": "2024-04-10T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-10T15:05:00.338443"}, "descriptions": [{"lang": "en", "value": "Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY"}, {"url": "https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20"}, {"url": "https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "affected": [{"vendor": "leantime", "product": "leantime", "cpes": ["cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.0.6", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-12T15:20:36.780437Z", "id": "CVE-2024-27476", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T17:52:37.790Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.312Z"}, "title": "CVE Program Container", "references": [{"url": "https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY", "tags": ["x_transferred"]}, {"url": "https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20", "tags": ["x_transferred"]}, {"url": "https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27476", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-12T15:20:36.780437Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*"], "vendor": "leantime", "product": "leantime", "versions": [{"status": "affected", "version": "3.0.6"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T17:47:36.928Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY"}, {"url": "https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20"}, {"url": "https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md"}], "descriptions": [{"lang": "en", "value": "Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-10T15:05:00.338443"}}}, "cveMetadata": {"cveId": "CVE-2024-27476", "state": "PUBLISHED", "dateUpdated": "2024-07-31T17:52:37.790Z", "dateReserved": "2024-02-26T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-10T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "B780DD5A-3641-45B4-A961-0EB7F71ABD75", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket."}, {"lang": "es", "value": "Leantime 3.0.6 es vulnerable a la inyecci\u00f3n de HTML a trav\u00e9s de /dashboard/show#/tickets/newTicket."}], "id": "CVE-2024-27476", "lastModified": "2025-04-08T15:22:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-04-10T15:16:04.923", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}