CVE-2021-3992: kimai2 is vulnerable to Improper Access Control
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.45419%
CWE
Published
12/3/2021
Updated
1/30/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| kevinpapst/kimai2 | composer | < 1.16.3 | 1.16.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from three key issues:
- In InvoiceController::previewAction, the original route accepted user-controlled template ID and customer ID parameters with insufficient permission checks (only 'view_invoice'), allowing parameter manipulation to access unauthorized data.
- CustomerRepository allowed customer ID injection in queries through form parameters without validation of the user's right to access those customers.
- CustomerVoter lacked specific team membership checks for customer access until the 'access' permission was implemented. The patch added multiple security annotations (@Security), team checks in the voter, and parameter validation controls to properly enforce access restrictions.