CVE-2024-41805

Published: Jul 26, 2024Modified: Jun 17, 2026Deferred

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: security-advisories@github.com (Secondary)

Description

Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting enables execution of malicious JavaScript in the context of a user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credential theft. Tracks version 2.7.1 is patched. No known complete workarounds are available.

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

https://github.com/TracksApp/tracks/commit/b0d288d2efd0f8020d04ca95b8e0738a9eab6c51

Source: security-advisories@github.com

https://github.com/TracksApp/tracks/commit/c23ca0574ec1149993476632ffd66643aec6aac2

Source: security-advisories@github.com

https://github.com/TracksApp/tracks/releases/tag/v2.7.1

Source: security-advisories@github.com

https://github.com/TracksApp/tracks/security/advisories/GHSA-fp4p-59hr-3695

Source: security-advisories@github.com

https://github.com/TracksApp/tracks/commit/b0d288d2efd0f8020d04ca95b8e0738a9eab6c51

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/TracksApp/tracks/commit/c23ca0574ec1149993476632ffd66643aec6aac2

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/TracksApp/tracks/releases/tag/v2.7.1

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/TracksApp/tracks/security/advisories/GHSA-fp4p-59hr-3695

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.