Security Resilience

CVE-2023-53957

Kimai 1.30.10

Public PoC
Published
19 December 2025
Modified
08 October 2026
Patch / advisory
View advisory
CVSS Score v4 8.5
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0059 47th percentile
Risk Priority 55 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-53957 is a high-severity Sensitive Cookie with Improper SameSite Attribute (CWE-1275) vulnerability in Kimai Kimai. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-53957 is a SameSite cookie vulnerability in Kimai version 1.30.10, a PHP-based time-tracking application. The flaw allows attackers to steal user session cookies by exploiting improper cookie attributes, specifically through a crafted PHP script that captures and writes session cookie data to a file on the server. This issue is rated critical with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-1275.

Any unauthenticated attacker with network access can exploit this vulnerability remotely with low complexity and no privileges required. By tricking victims into executing the crafted PHP script—potentially via social engineering or cross-site scripting—the attacker can capture valid session cookies, enabling session hijacking and unauthorized access to the victim's account in Kimai.

Advisories and references recommend mitigation through patching. The Kimai GitHub release page for tag 1.30.10 likely details fixes for this issue, urging users to upgrade to a patched version. An exploit is publicly available on Exploit-DB (ID 51278), and VulnCheck's advisory highlights the SameSite cookie misconfiguration leading to session hijacking, emphasizing immediate updates to prevent exploitation.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential…

more

session hijacking.

CWE(s)
CWE-1275

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1012 Query Registry Discovery
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
attack.mitre.org →
T1016.002 Wi-Fi Discovery Discovery
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
attack.mitre.org →
T1020 Automated Exfiltration Exfiltration
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-23626Same product: Kimai Kimai
CVE-2023-46245Same product: Kimai Kimai
CVE-2026-42267Same product: Kimai Kimai
CVE-2026-40479Same product: Kimai Kimai
CVE-2026-40486Same product: Kimai Kimai
CVE-2026-44298Same product: Kimai Kimai
CVE-2024-29200Same product: Kimai Kimai
CVE-2026-28685Same product: Kimai Kimai
CVE-2026-41498Same product: Kimai Kimai
CVE-2024-4596Same product: Kimai Kimai

Affected Assets

kimai
kimai
1.30.10

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.3.2

Mitigating Controls (NIST 800-53 r5) AI

CM-6 Configuration Settings good match

Establishing secure configuration settings for web components includes requiring appropriate SameSite attributes on sensitive cookies.

SC-23 Session Authenticity good match

Proper SameSite settings on session cookies directly help protect the authenticity of communications sessions against cross-site misuse.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 partial match
blocks

Secure configuration baselines and enforcement directly require proper SameSite settings on sensitive cookies.

PR.PS-06 partial match
blocks

Secure SDLC practices include coding standards and reviews that mandate correct SameSite attributes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including those that could address cookie attributes) be identified and specified during development; it does not itself enforce, implement or prevent the insecure SameSite configuration that enables the weakness

A.8.27 Secure system architecture and engineering principles partial match
removes
A.8.28 Secure coding partial match
prevents

Secure coding standards directly require proper SameSite settings to prevent CSRF.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect missing SameSite attributes but does not prevent the weakness.

A.8.8 Management of technical vulnerabilities partial match
removes
A.8.9 Configuration management partial match
removes

References