PT-2024-22803 · Kimai · Kimai

Astrogd · Published 2024-03-28 · Updated 2025-10-10 · CVE-2024-29200

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.13.0

Description The permission view other timesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the view other timesheet permission to true, on the frontend, users can only see timesheet entries for teams they are a part of. When requesting all timesheets from the API, however, all timesheet entries are returned, regardless of whether the user shares team permissions or not. This issue affects the confidentiality of timesheet entries.

Recommendations For Kimai versions prior to 2.13.0, update to version 2.13.0 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint /api/timesheets?user=all to minimize the risk of exploitation. Avoid using the view other timesheet permission until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-1220

Related Identifiers

CVE-2024-29200

GHSA-CJ3C-5XPM-CX94

Affected Products

Kimai

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29200.json · Exploit
• https://github.com/kimai/kimai/security/advisories/GHSA-cj3c-5xpm-cx94 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29200 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29200 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cj3c-5xpm-cx94 · Vendor Advisory
• https://github.com/kimai/kimai · Note
• https://github.com/kimai/kimai/releases/tag/2.13.0 · Note
• https://t.me/cveNotify/138190 · Telegram Post
• https://twitter.com/CVEnew/status/1773347427505840622 · Twitter Post
• https://t.me/cvenotify/74999 · Telegram Post