CVE-2020-15255

Katalog CVE

CVSS 7.3 · High EPSS 3,5%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada anuko time tracker. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.

Rincian

Terbit di NVD

16 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

3,5% peluang dieksploitasi; lebih tinggi dari 88,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42f patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv advisory pihak ketiga
• https://www.exploit-db.com/exploits/49027 exploit · advisory pihak ketiga · vdb entry