CVE-2021-41156mediumCWE-79

CVE-2021-41156: falha de média gravidade em anuko timetracker

Reflected XSS vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar timetracker

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.5%
anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
anuko · timetracker
CVEs relacionadas — anuko timetracker

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24707HIGHSQL injection in anuko timetrackerEPSS 7.2%CVE-2020-15255HIGHCSV injection in Anuko Time TrackerEPSS 3.5%CVE-2021-21352MEDIUMPredictable tokens used for password resetsEPSS 1.5%CVE-2021-43851HIGHSQL injection vulnerability in anuko timetrackerEPSS 1.2%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2023-32306HIGHTime Tracker has Blind SQL Injection Vulnerability in ReportsEPSS 0.7%