Vulnerability · Published Jul 26, 2024 · Assigned by GitHub_M

CVE-2024-41805Tracks vulnerable to reflected cross-site scripting

Medium 6.1

In plain English

A medium-severity cross-site scripting in tracks from TracksApp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 65.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting enables execution of malicious JavaScript in the context of a user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credential theft. Tracks version 2.7.1 is patched. No known complete workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
TracksApp	tracks	< 2.7.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/TracksApp/tracks/security/advisories/GHSA-fp4p-59hr-3695 x_refsource_CONFIRM
https://github.com/TracksApp/tracks/commit/b0d288d2efd0f8020d04ca95b8e0738a9eab6c51 x_refsource_MISC
https://github.com/TracksApp/tracks/commit/c23ca0574ec1149993476632ffd66643aec6aac2 x_refsource_MISC
https://github.com/TracksApp/tracks/releases/tag/v2.7.1 x_refsource_MISC