Vulnerability Description
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Anuko | Time Tracker | < 1.20.0.5646 |
Related Weaknesses (CWE)
References
- https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5ebPatchThird Party Advisory
- https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqhThird Party Advisory
- https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5ebPatchThird Party Advisory
- https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqhThird Party Advisory
FAQ
What is CVE-2022-24708?
CVE-2022-24708 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display...
How severe is CVE-2022-24708?
CVE-2022-24708 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24708?
Check the references section above for vendor advisories and patch information. Affected products include: Anuko Time Tracker.