PT-2025-13577 · Leantime · Leantime

Published 2025-02-21 · Updated 2025-04-07 · CVE-2025-28254

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Leantime versions 3.2.1 and earlier

Description The issue allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in the processMentions() function. This is a Cross Site Scripting vulnerability.

Recommendations For Leantime versions 3.2.1 and earlier, as a temporary workaround, consider restricting access to the processMentions() function until a patch is available. Avoid using the first name field in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-28254

GHSA-95J3-435G-VJCP

GHSA-JF6P-4HGV-V6QH

Affected Products

Leantime

References · 14

• https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 · Patch
• https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jf6p-4hgv-v6qh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-28254 · Security Note
• https://osv.dev/vulnerability/GHSA-95j3-435g-vjcp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-28254 · Vendor Advisory
• https://github.com/Leantime/leantime · Note
• https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128 · Note
• https://twitter.com/CVEnew/status/1905811740257894838 · Twitter Post
• https://t.me/cvenotify/118007 · Telegram Post
• https://t.me/cvedetector/21487 · Telegram Post
• https://t.me/cvetracker/20228 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1905861408094405066 · Twitter Post
• https://twitter.com/dailycve/status/1909283883104809131 · Twitter Post