CVE-2021-29436

HIGH 8.1CVE-2021-29436 · Published 13/04/2021 · updated 17/06/2026

In short

CVE-2021-29436 is a HIGH (CVSS 8.1) vulnerability affecting time tracker (anuko).
Chance of exploitation in the next 30 days (EPSS): 0.53%, higher than 44.6% of all vulnerabilities.
Fix: update to 1.19.27.5431 or later.

Package	Affected versions	Patched versions
time tracker anuko	`< 1.19.27.5431`	`1.19.27.5431`

Description

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().

References

anuko/timetracker commit e3f8222 · Patch
anuko/timetracker commit e77be7e · Patch
anuko/timetracker security advisory · Third Party Advisory

More vulnerabilities in time tracker

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

time tracker

anuko

< 1.19.27.5431

1.19.27.5431

Description

More vulnerabilities in time tracker

See all →