High severity · published Apr 8, 2022
CVE-2021-43515
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai
7.8
CVSS
1%
EPSS
No
On KEV
Description
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kimai · Kimai
before 1.14.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43515
Patch
https://github.com/kevinpapst/kimai2/commit/dad1b8b772947f1596175add1b4f33b791705507#diff-6774f5865dbaf8bc6c55b75bd92e6f9950ebe7834aa2efd828a19fd637e667cf
More from Kimai
9.6
CVE-2020-19825
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges
9.1
CVE-2026-52824
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
8.8
CVE-2026-80202
Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
8.8
CVE-2026-80193
Kimai before 2.62.0 Authorization Bypass via QuickEntry
8.8
CVE-2023-53957
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking