{"id":"CVE-2021-3983","published":"2021-12-01T11:15:12Z","modified":"2024-08-03T17:09:09Z","title":"Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2","vendor":"kevinpapst","product":"kevinpapst/kimai2","tier":"tail","description":{"text":"kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0079,"percentile":0.56164,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0","tags":["x_refsource_MISC"]}],"priority":{"score":15.6,"factors":[{"name":"EPSS percentile","points":11.23},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"kevinpapst","affectedVersions":[{"vendor":"kevinpapst","product":"kevinpapst/kimai2","versions":[">= unspecified, < 1.16.3"]}],"affected":[{"ecosystem":"Packagist","package":"kevinpapst/kimai2","vulnerableRanges":["<1.16.3"],"patched":["1.16.3"],"from":["GHSA-67c7-5v9j-227r"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2456","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-kevinpapst-kimai2-cve-2021-3983","children":[{"from":"CVE-2021-3983","to":"CVE-2021-3992","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["public/build/entrypoints.json","public/build/manifest.json"],"commits":["https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0","https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2021-3957","published":"2021-11-19","fixed":"1.16","kev":false},{"cve":"CVE-2021-3963","published":"2021-11-19","fixed":"1.16","kev":false},{"cve":"CVE-2021-3976","published":"2021-11-19","fixed":"1.16.2","kev":false,"link":{"from":"CVE-2021-3976","to":"CVE-2021-3983","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:kevinpapst/kimai2","fromFixed":"1.16.2","toFixed":"1.16.3","daysApart":12}]}},{"cve":"CVE-2021-3983","published":"2021-12-01","fixed":"1.16.3","kev":false},{"cve":"CVE-2021-3985","published":"2021-12-01","fixed":"1.16.3","kev":false},{"cve":"CVE-2021-3992","published":"2021-12-01","fixed":"1.16.3","kev":false},{"cve":"CVE-2021-4033","published":"2021-12-09","fixed":"1.16.7","kev":false}],"package":"Packagist:kevinpapst/kimai2"}}