{"id":"CVE-2021-3976","aliases":["GHSA-427q-jp8v-ww95"],"url":"https://o3.security/vulnerability/CVE-2021-3976","summary":"Cross-site Scripting in kimai2","details":"CSRF related to duplicate action. (the duplication occurs first before redirecting to edit form). This vulnerability is capable of tricking admin users to duplicate teams.","published":"2021-11-19T11:15:07.880Z","modified":"2026-08-27T08:39:39.264127Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"kevinpapst/kimai2","fixedVersion":"1.16.2"}],"fix":{"url":"https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e","label":"kevinpapst/kimai2@b28e9c1"},"references":[{"type":"FIX","url":"https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"},{"type":"FIX","url":"https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3976"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T08:39:39.264127Z"}}