CVE-2022-31149CWE-290

ActivityWatch vulnerable to DNS rebinding attack

High · published September 7, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01255 · 69.3th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2022-09-07T13:50Z
EPSS history
Timeline
  • 07 SEP 13:50Z
    ActivityWatch vulnerable to DNS rebinding attack
    cvelistv5