CVE-2021-29436CWE-352

Cross site request forgery vulnerability

Medium · published April 13, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00525 · 43.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-04-13T17:20Z
EPSS history
Timeline
  • 13 APR 17:20Z
    Cross site request forgery vulnerability
    cvelistv5