CVE-2024-27477

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://drive.proton.me/urls/35CKB8RV04#sEubCKVOuXqt	Broken Link
https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20	Product
https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md	Exploit Third Party Advisory
https://drive.proton.me/urls/35CKB8RV04#sEubCKVOuXqt	Broken Link
https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20	Product
https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md	Exploit Third Party Advisory
https://www.vicarius.io/vsociety/posts/analyzing-leantime-xss-for-the-fun-time-diving-into-cve-2024-27477-for-a-beginner	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-04-10 15:16

Updated : 2025-04-08 15:21

NVD link : CVE-2024-27477

Mitre link : CVE-2024-27477

CVE.ORG link : CVE-2024-27477

JSON object : View

Products Affected

leantime

leantime

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-27477", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-04-10T15:16:04.980", "references": [{"url": "https://drive.proton.me/urls/35CKB8RV04#sEubCKVOuXqt", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://drive.proton.me/urls/35CKB8RV04#sEubCKVOuXqt", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/analyzing-leantime-xss-for-the-fun-time-diving-into-cve-2024-27477-for-a-beginner", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks."}, {"lang": "es", "value": "En Leantime 3.0.6, existe una vulnerabilidad de Cross-Site Scripting dentro de la funcionalidad de creaci\u00f3n y modificaci\u00f3n de tickets, lo que permite a los atacantes inyectar c\u00f3digo JavaScript malicioso en el campo de t\u00edtulo de los tickets (tambi\u00e9n conocido como tareas pendientes). Esta vulnerabilidad XSS almacenada se puede aprovechar para realizar ataques de Server-Side Request Forgery (SSRF)."}], "lastModified": "2025-04-08T15:21:48.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B780DD5A-3641-45B4-A961-0EB7F71ABD75"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}