Stored XSS Vulnerability in Week View

CVE-2023-32066.

Week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Titles are displayed in tooltips on mouse hover over in week note cells, allowing to see a complete text for notes. Because of no escaping, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view.

Patches

The vulnerability was fixed in version 1.22.12.5783.

Workarounds

Use htmlspecialchars when calling $field->setTitle on line #245 in week.php file as in version 1.22.12.5783. The fixed line should look like this:

$field->setTitle(htmlspecialchars($table->getValueAt($row,$column)['note']));

Support

If you need help with upgrading or migrating your system you can order paid support. We can also host Time Tracker for your organization on our servers. If you have any questions feel free to contact us.