Kimai CVE-2021-3963

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2021-11-19 security@huntr.dev

CSRF Kimai Kimai 2

4.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Nov 19, 2021 - 12:15 nvd

MEDIUM 4.3

DescriptionNVD

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

AnalysisAI

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Affected products include: Kimai Kimai 2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Kimai

View all

CVE-2021-3985 CRITICAL Act Now POC

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated crit

CVE-2023-46245 HIGH This Week POC

Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel

CVE-2026-23626 MEDIUM This Month POC

Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that

CVE-2026-28685 MEDIUM This Month POC

Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user

CVE-2024-29200 MEDIUM This Month POC

Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot

CVE-2021-4033 MEDIUM This Month POC

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remot

CVE-2021-3976 MEDIUM This Month POC

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remot

CVE-2019-25317 MEDIUM This Month POC

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into

CVE-2026-80202 CRITICAL Act Now

Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin

CVE-2026-80196 HIGH This Week

Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC

CVE-2026-80193 HIGH This Week

Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an

CVE-2026-80198 HIGH This Week

Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded inv

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all

CVE-2016-6277 HIGH POC

CVE-2014-100005 HIGH POC

CVE-2013-5696 MEDIUM POC

CVE-2020-36836 HIGH POC

CVE-2015-2295 MEDIUM POC

CVE-2016-6897 MEDIUM POC

CVE-2022-41622 HIGH POC

CVE-2025-2907 CRITICAL POC

Same technique CSRF

View all

CVE-2016-6277 HIGH POC

CVE-2014-100005 HIGH POC

CVE-2017-9757 HIGH POC

CVE-2013-5696 MEDIUM POC

CVE-2013-4152 MEDIUM POC

CVE-2024-7094 CRITICAL

CVE-2015-4624 HIGH POC

CVE-2020-36836 HIGH POC

Share

CVE-2021-3963 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy