CVE-2024-4596

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-4596
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4596.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-4596
Aliases
Published
2024-05-07T15:31:04.459Z
Modified
2026-08-12T03:51:22.062135810Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Kimai Session information disclosure
Details

A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-263318 is the identifier assigned to this vulnerability.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4596.json"
}
References

Affected packages

Git / github.com/kimai/kimai

Affected ranges

Type
GIT
Repo
https://github.com/kimai/kimai
Events
Introduced
d481f6826612055101d9642cf85de6bfb80189a9
Fixed
99c296a751d66cdc64196af8f2daaf7f9b8dd416
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.1"
        },
        {
            "last_affected": "2.1"
        },
        {
            "introduced": "2.2"
        },
        {
            "last_affected": "2.2"
        },
        {
            "introduced": "2.3"
        },
        {
            "last_affected": "2.3"
        },
        {
            "introduced": "2.4"
        },
        {
            "last_affected": "2.4"
        },
        {
            "introduced": "2.5"
        },
        {
            "last_affected": "2.5"
        },
        {
            "introduced": "2.6"
        },
        {
            "last_affected": "2.6"
        },
        {
            "introduced": "2.7"
        },
        {
            "last_affected": "2.7"
        },
        {
            "introduced": "2.8"
        },
        {
            "last_affected": "2.8"
        },
        {
            "introduced": "2.9"
        },
        {
            "last_affected": "2.9"
        },
        {
            "introduced": "2.10"
        },
        {
            "last_affected": "2.10"
        },
        {
            "introduced": "2.11"
        },
        {
            "last_affected": "2.11"
        },
        {
            "introduced": "2.12"
        },
        {
            "last_affected": "2.12"
        },
        {
            "introduced": "2.13"
        },
        {
            "last_affected": "2.13"
        },
        {
            "introduced": "2.14"
        },
        {
            "last_affected": "2.14"
        },
        {
            "introduced": "2.15"
        },
        {
            "last_affected": "2.15"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2.16.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28
2.0.29
2.0.3
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1
2.1.0
2.10
2.10.0
2.11
2.11.0
2.12
2.12.0
2.13
2.13.0
2.14
2.14.0
2.15
2.15.0
2.2
2.2.0
2.2.1
2.3
2.3.0
2.4
2.4.0
2.4.1
2.5
2.5.0
2.6
2.6.0
2.7
2.7.0
2.8
2.8.0
2.9
2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4596.json"