PT-2021-23121 · Anuko · Anuko Time Tracker

Indevi0Us · Published 2021-10-13 · Updated 2021-10-20 · CVE-2021-41139

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker versions prior to 1.19.30.5600

Description Anuko Time Tracker is a web-based time tracking application written in PHP. The application is vulnerable to an issue where a logged-on user's selection of a date can be manipulated by passing malicious JavaScript via the date parameter in the URI. This can be exploited using social engineering to convince the user to click on a crafted link, allowing the attacker-supplied JavaScript to be executed in the user's browser.

Recommendations For versions prior to 1.19.30.5600, update to version 1.19.30.5600 to resolve the issue. As a temporary workaround, consider introducing the ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block in time.php.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41139

GHSA-H2V8-87C9-86CW

Affected Products

Anuko Time Tracker

References · 6

• https://github.com/anuko/timetracker/commit/559906731f153c9b3a632c2839ed11669b76d593 · Patch
• https://github.com/anuko/timetracker/commit/d3f60bd3e3ea8ff8ec31a596baec6750af601b7c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41139 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41139 · Vendor Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-h2v8-87c9-86cw · Note
• https://t.me/cibsecurity/30526 · Telegram Post