CVE-2023-32066CWE-79

Time Tracker has Stored XSS vulnerability in Week View plugin

Medium · published May 9, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00369 · 29.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-05-09T15:28Z
EPSS history
Timeline
  • 09 MAY 15:28Z
    Time Tracker has Stored XSS vulnerability in Week View plugin
    cvelistv5