Vulnerability · Published Oct 18, 2021 · Assigned by GitHub_M

CVE-2021-41156Reflected XSS vulnerability

Medium 6.8

In plain English

A medium-severity cross-site scripting in timetracker from anuko. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.

Affected products (as reported)

Vendor	Product	Versions
anuko	timetracker	< 1.19.30.5601

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/anuko/timetracker/security/advisories/GHSA-g9cc-m4p4-6xpc x_refsource_CONFIRM