Time Tracker has Stored XSS vulnerability in Week View plugin
CVE-2023-32066

5.4MEDIUM

Key Information:

Vendor

Anuko

Status
Timetracker
Vendor
CVE Published:
9 May 2023

What is CVE-2023-32066?

Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use htmlspecialchars when calling $field->setTitle on line #245 in the week.php file, as happens in version 1.22.12.5783.

Affected Version(s)

timetracker < 1.22.12.5783

References

https://github.com/anuko/timetracker/security/advisories/...
x_refsource_CONFIRM
https://github.com/anuko/timetracker/commit/093cfe1580997...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.