CVE-2022-31149: ActivityWatch vulnerable to DNS rebinding attack
ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31149?
CVE-2022-31149 has a high severity due to the potential full access an attacker can have to the ActivityWatch REST API.
How do I fix CVE-2022-31149?
To fix CVE-2022-31149, you should upgrade ActivityWatch to version 0.12.0b2 or later.
Who is affected by CVE-2022-31149?
CVE-2022-31149 affects everyone running versions of ActivityWatch prior to 0.12.0b2.
What type of attack is CVE-2022-31149 associated with?
CVE-2022-31149 is associated with DNS rebinding attacks that can compromise the security of the ActivityWatch application.
What could an attacker gain from exploiting CVE-2022-31149?
An attacker exploiting CVE-2022-31149 could gain full access to sensitive user data via the ActivityWatch REST API.