CVE-2021-21352 Predictable tokens used for password resets
Predictable password reset tokens allow attackers to guess tokens and take over user accounts, including administrators, in Anuko Time Tracker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21352?
CVE-2021-21352 is a medium-severity vulnerability in anuko timetracker, published on 3 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing).
Weakness: CWE-330
Which versions are affected by CVE-2021-21352?
It affects 1 product.
Products include Anuko Time Tracker.
How do I fix CVE-2021-21352?
No fix has been published for CVE-2021-21352 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21352 being exploited?
There is no known exploitation of CVE-2021-21352 in the wild and no public exploit code.