CVE-2023-32066

Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb	Patch
https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw	Third Party Advisory
https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb	Patch
https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:02

Type	Values Removed	Values Added
References	~~() https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb - Patch~~	() https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb - Patch
References	~~() https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw - Third Party Advisory~~	() https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw - Third Party Advisory

Information

Published : 2023-05-09 16:15

Updated : 2024-11-21 08:02

NVD link : CVE-2023-32066

Mitre link : CVE-2023-32066

CVE.ORG link : CVE-2023-32066

JSON object : View

Products Affected

anuko

time_tracker

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-32066", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2023-05-09T16:15:15.160", "references": [{"url": "https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783."}], "lastModified": "2024-11-21T08:02:38.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "144881B4-9A01-4919-BACC-8364C75FBF1C", "versionEndExcluding": "1.22.12.5783"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}