CVE-2022-24708

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330	Patch Third Party Advisory
https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqh	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-02-24 16:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-24708

Mitre link : CVE-2022-24708

CVE.ORG link : CVE-2022-24708

JSON object : View

Products Affected

anuko

time_tracker

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-24708", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}]}, "published": "2022-02-24T16:15:08.300", "references": [{"url": "https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqh", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name."}, {"lang": "es", "value": "Anuko Time Tracker es una aplicaci\u00f3n de seguimiento del tiempo basada en la web y de c\u00f3digo abierto escrita en PHP. ttUser.class.php en Time Tracker versiones anteriores a 1.20.0.5646, no escapaba el nombre del grupo primario para su visualizaci\u00f3n. Debido a esto, era posible que un usuario conectado modificara el nombre del grupo primario con elementos de JavaScript. Dicho script pod\u00eda ser ejecutado en el navegador del usuario en peticiones posteriores en p\u00e1ginas donde fuera mostrado el nombre del grupo primario. Esta vulnerabilidad ha sido corregida en versi\u00f3n 1.20.0.5646. Los usuarios que no puedan actualizar pueden modificar ttUser.class.php para usar una llamada adicional a htmlspecialchars cuando es impreso el nombre del grupo"}], "lastModified": "2022-03-04T17:43:37.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBE3E8DC-1EF3-451E-B15C-868B6DF653E6", "versionEndExcluding": "1.20.0.5646"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}