CVE-2021-29436 Cross site request forgery vulnerability
Anuko Time Tracker allows CSRF attacks enabling attackers to trick logged-in users into changing passwords or performing unintended actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-29436?
CVE-2021-29436 is a medium-severity vulnerability in anuko timetracker, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().
Weakness: CWE-352
Which versions are affected by CVE-2021-29436?
It affects 1 product.
Products include Anuko Time Tracker.
How do I fix CVE-2021-29436?
No fix has been published for CVE-2021-29436 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-29436 being exploited?
There is no known exploitation of CVE-2021-29436 in the wild and no public exploit code.