XSS in Anuko Timetracker
CVE-2021-41156
anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.005 (38.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Anuko Timetracker — versions < 1.19.30.5601
- Timetracker_project Timetracker
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-41156?
- CVE-2021-41156 is a medium-severity vulnerability in Anuko Timetracker, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2021-10-18.
- How severe is CVE-2021-41156?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2021-41156 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.