CVE-2024-4596 Kimai Session information disclosure

What is CVE-2024-4596?

CVE-2024-4596 is a low-severity vulnerability in Kimai, published on 7 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-263318 is the identifier assigned to this vulnerability.

Weakness: CWE-200

Which versions are affected by CVE-2024-4596?

2 open source packages ship an affected version, including kimai/kimai. It affects 1 product.

Products include Kimai Kimai.

How do I fix CVE-2024-4596?

Upgrade kimai/kimai to 2.16.0 or later.

Is CVE-2024-4596 being exploited?

There is no known exploitation of CVE-2024-4596 in the wild and no public exploit code.

Other vulnerabilities in Kimai

• CVE-2020-19825 Cross-site Scripting in kimai/kimai Critical 9.6
• CVE-2023-53957 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking High 8.5
• CVE-2021-43515 Improper Neutralization of Formula Elements in a CSV File in Kimai 2 High 7.8
• CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File High 7.2
• CVE-2026-23626 Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI) Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6f3v-2r2j-2rpr.