CVE-2022-24708: fallo de gravedad media en anuko timetracker
Stored XSS vulnerability in anuko/timetracker
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.6%
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Productos afectados
anuko · timetrackerCVEs relacionadas — anuko timetracker
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-24707HIGHSQL injection in anuko timetrackerEPSS 7.2%CVE-2020-15255HIGHCSV injection in Anuko Time TrackerEPSS 3.5%CVE-2021-21352MEDIUMPredictable tokens used for password resetsEPSS 1.5%CVE-2021-43851HIGHSQL injection vulnerability in anuko timetrackerEPSS 1.2%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2023-32306HIGHTime Tracker has Blind SQL Injection Vulnerability in ReportsEPSS 0.7%