CVE-2021-29436 - OpenCVE

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Anuko	Time Tracker

Configuration 1 [-]

cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563
https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e
https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-04-13T17:20:14

Updated: 2024-08-03T22:02:51.962Z

Reserved: 2021-03-30T00:00:00

Link: CVE-2021-29436

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-04-13T20:15:22.000

Modified: 2021-04-26T18:27:28.597

Link: CVE-2021-29436

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "timetracker", "vendor": "anuko", "versions": [{"status": "affected", "version": "< 1.19.27.5431"}]}], "descriptions": [{"lang": "en", "value": "Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed()."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "{\"CWE-352\":\"Cross-Site Request Forgery (CSRF)\"}", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-13T17:20:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e"}], "source": {"advisory": "GHSA-pgpx-rfvj-9g4f", "discovery": "UNKNOWN"}, "title": "Cross site request forgery vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-29436", "STATE": "PUBLIC", "TITLE": "Cross site request forgery vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "timetracker", "version": {"version_data": [{"version_value": "< 1.19.27.5431"}]}}]}, "vendor_name": "anuko"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed()."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "{\"CWE-352\":\"Cross-Site Request Forgery (CSRF)\"}"}]}]}, "references": {"reference_data": [{"name": "https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f", "refsource": "CONFIRM", "url": "https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f"}, {"name": "https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563", "refsource": "MISC", "url": "https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563"}, {"name": "https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e", "refsource": "MISC", "url": "https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e"}]}, "source": {"advisory": "GHSA-pgpx-rfvj-9g4f", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T22:02:51.962Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-29436", "datePublished": "2021-04-13T17:20:14", "dateReserved": "2021-03-30T00:00:00", "dateUpdated": "2024-08-03T22:02:51.962Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AA337D3-0BE0-449A-9E94-A08AD1153B35", "versionEndExcluding": "1.19.27.5431", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed()."}, {"lang": "es", "value": "Anuko Time Tracker es una aplicaci\u00f3n de seguimiento del tiempo de c\u00f3digo abierto basada en web escrita en PHP. En Time Tracker versiones anteriores a 1.19.27.5431, se presentaba una vulnerabilidad de tipo Cross site request forgery (CSRF). La naturaleza de CSRF es que un usuario que ha iniciado sesi\u00f3n puede ser enga\u00f1ado por ingenier\u00eda social para que haga clic en un formulario proporcionado por un atacante que ejecuta una acci\u00f3n no prevista, tal y como cambiar la contrase\u00f1a del usuario. La vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.19.27.5431 de Time Tracker. Una actualizaci\u00f3n es recomendada. Si la actualizaci\u00f3n no es pr\u00e1ctica, introduzca la funci\u00f3n ttMitigateCSRF() en la biblioteca /WEB-INF/lib/common.php.lib usando el \u00faltimo c\u00f3digo disponible y ll\u00e1melo desde la funci\u00f3n ttAccessAllowed()"}], "id": "CVE-2021-29436", "lastModified": "2021-04-26T18:27:28.597", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-04-13T20:15:22.000", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Primary"}]}