CyberRota Analysis
AI-GeneratedLeantime 3.6.2 is vulnerable to a cross-site request forgery (CSRF) attack, allowing unauthenticated attackers to execute state-changing actions on behalf of authenticated users due to the exclusion of the Laravel VerifyCsrfToken middleware. This flaw can lead to unauthorized modifications, including project creation, deletion, and changes to settings and permissions. Organizations using this version should prioritize patching to mitigate the risk of exploitation through phishing or malicious web pages.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.