Cross site request forgery vulnerability
CVE-2021-29436

5.4MEDIUM

Key Information:

Vendor

Anuko

Status
Timetracker
Vendor
CVE Published:
13 April 2021

What is CVE-2021-29436?

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().

Affected Version(s)

timetracker < 1.19.27.5431

References

https://github.com/anuko/timetracker/security/advisories/...
x_refsource_CONFIRM
https://github.com/anuko/timetracker/commit/e3f8222ee3083...
x_refsource_MISC
https://github.com/anuko/timetracker/commit/e77be7eea69df...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.