PT-2020-14318 · Anuko · Anuko Time Tracker

Muffyhub · Published 2020-10-16 · Updated 2021-11-18 · CVE-2020-15255

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker versions prior to 1.19.23.5325

Description The issue arises from not properly filtering user input, which can lead to a CSV export of a report containing cells that are treated as formulas by spreadsheet software. This occurs when a cell value starts with an equal sign.

Recommendations For versions prior to 1.19.23.5325, update to version 1.19.23.5325 to resolve the issue.

Exploit

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-1236

Related Identifiers

CVE-2020-15255

GHSA-PRJF-9MGH-8FPV

Affected Products

Anuko Time Tracker

References · 6

• 🔥 http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/49027 · Exploit
• https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42f · Patch
• https://osv.dev/vulnerability/CVE-2020-15255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15255 · Security Note
• https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv · Note