CVE-2024-4596

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-263318 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-459604.8Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is CVE-2024-459624.7October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the filCVE-2024-459644.8Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.CVE-2024-459655.4Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.xCVE-2024-459674.7Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.CVE-2024-459697.5NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malicCVE-2024-45976.5An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, aCVE-2024-459709.8Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a maliCVE-2024-459719.8Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a maliCVE-2024-459798.8A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with CVE-2024-45986.5An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. AuthenticateCVE-2024-459808.8A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a craft