CVE-2023-46245CWE-1336

Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

High · published October 31, 2023

CVSS v3.1
7.2
EPSS
1%
Percentile
73.5
In the wild
Unconfirmed
What it is

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01466 · 73.5th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2023-10-31T15:06Z
EPSS history
Timeline
  • 31 OCT 15:06Z
    Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
    cvelistv5