CVE-2022-24708

    Dashboard / Vulnerabilities / CVE-2022-24708

    CVE-2022-24708

    Published: 23 Feb 2022Last Modified: 2 Apr 2026

    Summary: Stored XSS vulnerability in anuko/timetracker

    Details: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24708.json, https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqh, https://nvd.nist.gov/vuln/detail/CVE-2022-24708, https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6aaad31630500d13b6c8459daa9f406fd5eb4330

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24708 | CVE-DB