GHSA-jf6p-4hgv-v6qh

Suggest an improvement
Source
https://github.com/advisories/GHSA-jf6p-4hgv-v6qh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-jf6p-4hgv-v6qh/GHSA-jf6p-4hgv-v6qh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jf6p-4hgv-v6qh
Withdrawn
2025-03-31T15:57:39Z
Published
2025-03-28T21:30:47Z
Modified
2025-03-31T16:34:19Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references.

Original Description

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

Database specific 
{
    "cwe_ids":  [
        "CWE-80"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-31T15:57:39Z",
    "nvd_published_at":  "2025-03-28T21:15:17Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / leantime/leantime

Package

Name
leantime/leantime
Purl
pkg:composer/leantime/leantime

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.3

Affected versions

v2.*
v2.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.2.10
v2.2.11
v2.3.0-beta
v2.3.1-beta
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
2.*
2.4-beta
2.4-beta-7
2.4-beta-8
2.4
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.*
3.0.0-beta
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0-beta
3.2.0-beta-2
3.2.0
3.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-jf6p-4hgv-v6qh/GHSA-jf6p-4hgv-v6qh.json"