CVE-2023-46245 - CVE House
Back to Database
Status published High CVE-2023-46245

Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

Vulnerability Description

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46245

Credits & Attribution

No credits recorded in the NVD database.

References

More from kimai

View All →
CVE-2024-29200
API returns timesheet entries a user should not be authorized to view
Medium 6.8
CVE-2021-43515
CSV Injection (aka Excel Macro Injection or Formula Injection) exists...
High 7.8
CVE-2020-19825
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in...
Unknown 0
CVE-2019-15481
Kimai v2 before 1.1 has XSS via a timesheet description....
Medium 6.1

Affected Vendor

Affected Software

kimai
Vulnerable Versions:
< 2.1.0

Timeline

Official Publish: October 31st, 2023
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1336

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.