CVE-2023-32066: fallo de gravedad media en anuko timetracker
Time Tracker has Stored XSS vulnerability in Week View plugin
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.4%
Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
anuko · timetrackerCVEs relacionadas — anuko timetracker
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-24707HIGHSQL injection in anuko timetrackerEPSS 7.2%CVE-2020-15255HIGHCSV injection in Anuko Time TrackerEPSS 3.5%CVE-2021-21352MEDIUMPredictable tokens used for password resetsEPSS 1.5%CVE-2021-43851HIGHSQL injection vulnerability in anuko timetrackerEPSS 1.2%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2023-32306HIGHTime Tracker has Blind SQL Injection Vulnerability in ReportsEPSS 0.7%