CVE-2020-19825: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

February 16, 2023

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.

References

github.com/advisories/GHSA-r58m-v5pr-jhhq
github.com/kimai/kimai/pull/962
github.com/kimai/kimai/releases/tag/1.1
nvd.nist.gov/vuln/detail/CVE-2020-19825

Code Behaviors & Features

Detect and mitigate CVE-2020-19825 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →