Cross Site Scripting Vulnerability in Timesheet Next Gen by Timesheet
CVE-2019-1010287

6.1MEDIUM

Key Information:

Vendor

Timesheet Next Gen

Status
Timesheet Next Gen
Vendor
CVE Published:
17 July 2019

What is CVE-2019-1010287?

The Timesheet Next Gen application version 1.5.3 and earlier is susceptible to a Cross Site Scripting (XSS) vulnerability. This flaw allows an attacker to execute arbitrary HTML and JavaScript code through a maliciously crafted 'redirect' parameter in the web login form (login.php). When a victim unknowingly clicks on a harmful URL, it can lead to exposure of sensitive information or unauthorized actions within their session.

Affected Version(s)

Timesheet Next Gen 1.5.3 and earlier

References

https://sourceforge.net/p/tsheetx/discussion/779083/threa...
x_refsource_MISC
https://sourceforge.net/p/tsheetx/code/497/tree/branches/...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.