PT-2023-23580 · Unknown · Time Tracker

Indevi0Us · Publicado 2023-05-09 · Atualizado 2023-05-17 · CVE-2023-32066

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Time Tracker versions 1.22.11.5782 and prior

Description The week view plugin in Time Tracker was not escaping titles for notes in the week view table, allowing a logged-in user to enter notes with JavaScript elements. This could lead to the execution of scripts in the user's browser on subsequent requests to the week view.

Recommendations For versions 1.22.11.5782 and prior, as a temporary workaround, consider using htmlspecialchars when calling $field->setTitle on line #245 in the week.php file until a patch is available. Update to version 1.22.12.5783 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-32066

GHSA-JW2G-8WVP-9FRW

Produtos afetados

Time Tracker

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32066.json · Exploit
• https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb · Correção
• https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw · Nota
• https://osv.dev/vulnerability/CVE-2023-32066 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32066 · Nota de Segurança
• https://t.me/cibsecurity/63637 · Publicação no Telegram