CyberRota Analysis
AI-GeneratedThe Kimai time tracking application prior to version 2.58.0 is vulnerable due to the TimesheetController's exposure of GET endpoints that allow state-changing operations without proper request-forgery protections. A remote attacker can exploit this flaw to manipulate timesheets on behalf of authenticated users, potentially leading to unauthorized changes in time records and billing data. Organizations using Kimai should prioritize upgrading to version 2.58.0 to mitigate the risk of these unauthorized actions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in version 2.58.0.