Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-29200
CVE-2024-29200:
PHP vulnerability analysis and mitigation
Overview
Kimai, a web-based multi-user time-tracking application, was found to have a vulnerability (CVE-2024-29200) where the permission 'viewothertimesheet' behaved inconsistently between the UI and API interfaces. The vulnerability was discovered and disclosed in March 2024, affecting all versions prior to 2.13.0 (GitHub Advisory).
Technical details
The vulnerability stems from a discrepancy in permission handling between the UI and API interfaces. When the 'viewothertimesheet' permission is enabled, the UI correctly restricts users to viewing timesheet entries only for teams they are part of. However, the API endpoint returns all timesheet entries regardless of team permissions. This inconsistency is classified with a CVSS v3.1 score of 6.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N (GitHub Advisory).
Impact
The vulnerability compromises data confidentiality by allowing users to access timesheet entries they should not be authorized to view. This is particularly significant as API access is necessary for features like mobile app functionality, making it impossible to mitigate by simply restricting API access to administrators (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been fixed in Kimai version 2.13.0. Users are advised to upgrade to this version or later to address the security issue. No alternative workarounds are available, as restricting API access is not a viable solution due to legitimate API usage requirements (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management