Time Tracker
CVE-2019-12162
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
AnalysisAI
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-494. Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe. Affected products include: Upwork Time Tracker.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Time Tracker
View allAnuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.8)
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could
anuko timetracker is an open source time tracking system. Rated critical severity (CVSS 9.8), this vulnerability is remo
Time Tracker is an open source time tracking system. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an a
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated critical severity (CVSS
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.8)
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.1)
Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial o
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated medium severity (CVSS 6.
Time Tracker is an open source time tracking system. Rated medium severity (CVSS 5.4), this vulnerability is remotely ex
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated medium severity (CVSS 5.
Same weakness CWE-494 – Download of Code Without Integrity Check
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today