PT-2023-23580 · Unknown · Time Tracker

Indevi0Us · Published 2023-05-09 · Updated 2023-05-17 · CVE-2023-32066

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Time Tracker versions 1.22.11.5782 and prior

Description The week view plugin in Time Tracker was not escaping titles for notes in the week view table, allowing a logged-in user to enter notes with JavaScript elements. This could lead to the execution of scripts in the user's browser on subsequent requests to the week view.

Recommendations For versions 1.22.11.5782 and prior, as a temporary workaround, consider using htmlspecialchars when calling $field->setTitle on line #245 in the week.php file until a patch is available. Update to version 1.22.12.5783 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-32066

GHSA-JW2G-8WVP-9FRW

Affected Products

Time Tracker

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32066.json · Exploit
• https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb · Patch
• https://osv.dev/vulnerability/CVE-2023-32066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32066 · Security Note
• https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw · Note
• https://t.me/cibsecurity/63637 · Telegram Post