Описание
ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1.
Ссылки
- ExploitThird Party Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.12.0 (исключая)
Одно из
cpe:2.3:a:activitywatch:activitywatch:*:*:*:*:*:*:*:*
cpe:2.3:a:activitywatch:activitywatch:0.12.0:beta1:*:*:*:*:*:*
EPSS
Процентиль: 63%
0.00436
Низкий
8.8 High
CVSS3
9.6 Critical
CVSS3
Дефекты
CWE-290
Связанные уязвимости
CVSS3: 8.8
debian
больше 3 лет назад
ActivityWatch open-source automated time tracker. Versions prior to 0. ...
EPSS
Процентиль: 63%
0.00436
Низкий
8.8 High
CVSS3
9.6 Critical
CVSS3
Дефекты
CWE-290