CSRF in Anuko Time Tracker
CVE-2021-29436
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (41.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.
Affected products
- Anuko Time_tracker
- Anuko Timetracker — versions < 1.19.27.5431
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-29436?
- CVE-2021-29436 is a medium-severity vulnerability in Anuko Time Tracker, classified under Cross-Site Request Forgery (CSRF). CVSS score: 5.4/10. Published 2021-04-13.
- How severe is CVE-2021-29436?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2021-29436 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.