CVE-2023-32066
Medium
Description
Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.
SeverityMedium
CVSS5.4
Exploit probability—
ProductAnuko Time Tracker
PublishedMay 9, 2023
First seenMay 9, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- anuko time_tracker1.22.12.5783 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| anuko time_tracker | v < 1.22.12.5783 | 1.22.12.5783 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.