Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. leantime/leantime
  4. ›
  5. GHSA-h6w8-27ph-c385

GHSA-h6w8-27ph-c385: Leantime has Insufficiently Protected Credentials

February 21, 2025

Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore.

Additional Information:

1.The issue was identified during routine security testing. 2.This vulnerability poses a significant risk to user privacy and data security. 3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.

References

  • github.com/Leantime/leantime
  • github.com/Leantime/leantime/security/advisories/GHSA-h6w8-27ph-c385
  • github.com/advisories/GHSA-h6w8-27ph-c385

Code Behaviors & Features

Detect and mitigate GHSA-h6w8-27ph-c385 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.3

Fixed versions

  • 3.3

Solution

Upgrade to version 3.3 or above.

Weakness

  • CWE-522: Insufficiently Protected Credentials

Source file

packagist/leantime/leantime/GHSA-h6w8-27ph-c385.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:54 +0000.