PT-2025-7639 · Packagist · Leantime/Leantime

Published 2025-02-21 · Updated 2025-02-21

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description A Stored Cross-Site Scripting (XSS) issue was discovered, posing a significant security risk to the platform. This issue occurs when a malicious script is injected directly into a vulnerable web application, potentially compromising user data. An attacker could execute malicious scripts in the context of a victim's browser, leading to session hijacking, stealing sensitive information, or compromising the platform's security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-63CR-XG3F-8JVR

Affected Products

Leantime/Leantime

References · 4

• https://osv.dev/vulnerability/GHSA-63cr-xg3f-8jvr · Vendor Advisory
• https://github.com/Leantime/leantime · Note
• https://github.com/Leantime/leantime/security/advisories/GHSA-63cr-xg3f-8jvr · Note
• https://youtu.be/kqKFgsOqstg · Note