CVE-2022-24708

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247096.1@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface CVE-2022-24719.8Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DB CVE-2022-247105.4Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used i CVE-2022-247119.8CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerab CVE-2022-247128.8CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote CVE-2022-247137.5regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of CVE-2022-247145.3Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer CVE-2022-247158.8Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the confi CVE-2022-247167.5Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents o CVE-2022-247176.1ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) i CVE-2022-247186.5ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occ CVE-2022-247196.1Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of