PT-2022-16817 · Unknown · Anuko Time Tracker

Indevi0Us · Published 2022-02-23 · Updated 2022-03-04 · CVE-2022-24708

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker versions prior to 1.20.0.5646

Description Anuko Time Tracker is an open source, web-based time tracking application written in PHP. The issue arises from the ttUser.class.php file not escaping the primary group name for display, allowing a logged-in user to modify it with JavaScript elements. This could lead to the execution of scripts in a user's browser on subsequent requests to pages where the primary group name is displayed.

Recommendations For versions prior to 1.20.0.5646, upgrade to version 1.20.0.5646 to resolve the issue. As a temporary workaround for users unable to upgrade, modify ttUser.class.php to use an additional call to htmlspecialchars when printing the group name.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24708

GHSA-RGCM-XGVJ-5MQH

Affected Products

Anuko Time Tracker

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24708.json · Exploit
• https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24708 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24708 · Vendor Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqh · Note
• https://t.me/cvenotify/27772 · Telegram Post