CVE-2023-32066 Time Tracker has Stored XSS vulnerability in Week View plugin

What is CVE-2023-32066?

CVE-2023-32066 is a medium-severity cross-site scripting vulnerability in anuko timetracker, published on 9 May 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.

Weakness: CWE-79

Which versions are affected by CVE-2023-32066?

It affects 1 product.

Products include Anuko Time Tracker.

How do I fix CVE-2023-32066?

No fix has been published for CVE-2023-32066 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-32066 being exploited?

There is no known exploitation of CVE-2023-32066 in the wild and no public exploit code.

Other vulnerabilities in anuko timetracker

• CVE-2020-27422 Business logic in n/a Critical 9.8
• CVE-2023-32306 Time Tracker has Blind SQL Injection Vulnerability in Reports High 8.8
• CVE-2020-15255 CSV injection in Anuko Time Tracker High 8.7
• CVE-2023-32308 SQL Injection Vulnerability in anuko timetracker High 8.2
• CVE-2021-43851 SQL injection vulnerability in anuko timetracker High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jw2g-8wvp-9frw.