PT-2021-23136 · Unknown · Anuko Time Tracker

Indevi0Us · Published 2021-10-18 · Updated 2021-10-22 · CVE-2021-41156

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions anuko/timetracker versions prior to 1.19.30.5601

Description The issue concerns anuko/timetracker, an open-source time tracking system. In affected versions, the system uses a browser today hidden control to collect the current date from user browsers. Due to the lack of sanity checks on this parameter in versions prior to 1.19.30.5601, it is possible to craft an HTML form with malicious JavaScript. An attacker could use social engineering to convince logged-on users to execute a POST request from such a form, resulting in the execution of attacker-supplied JavaScript in the user's browser.

Recommendations For versions prior to 1.19.30.5601, upgrade to version 1.19.30.5601 or later. If an upgrade is not practical, introduce the ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41156

GHSA-G9CC-M4P4-6XPC

Affected Products

Anuko Time Tracker

References · 4

• https://osv.dev/vulnerability/CVE-2021-41156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41156 · Security Note
• https://github.com/anuko/timetracker/security/advisories/GHSA-g9cc-m4p4-6xpc · Note
• https://t.me/cibsecurity/30736 · Telegram Post