Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
Weakness
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kimai | Kimai | 1.30.10 (including) | 1.30.10 (including) |