NVD Vulnerability Detail

CVE-2021-29436

Summary	Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().
Publication Date	April 14, 2021, 5:15 a.m.
Registration Date	April 14, 2021, 10:05 a.m.
Last Update	Nov. 21, 2024, 3:01 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:anuko:time_tracker::::::::					1.19.27.5431

Related information, measures and tools

No	URL	タグ
1	https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563	Patch Third Party Advisory
2	https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563	Patch Third Party Advisory
3	https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e	Patch Third Party Advisory
4	https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e	Patch Third Party Advisory
5	https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f	Third Party Advisory
6	https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Anuko Time Tracker におけるクロスサイトリクエストフォージェリの脆弱性

Title	Anuko Time Tracker におけるクロスサイトリクエストフォージェリの脆弱性
Summary	Anuko Time Tracker には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 12, 2021, midnight
Registration Date	Dec. 22, 2021, 3:04 p.m.
Last Update	Dec. 22, 2021, 3:04 p.m.

Affected System

Anuko

Time Tracker 1.19.27.5431

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-29436	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29436
National Vulnerability Database (NVD)
2	CVE-2021-29436	https://nvd.nist.gov/vuln/detail/CVE-2021-29436

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
GitHub
1	An attempt to mitigate cross site request forgery vulnerability.	https://github.com/anuko/timetracker/commit/e77be7eea69df5d52e19f9f25b5b89a0e66a5b8e
2	Cross site request forgery vulnerability	https://github.com/anuko/timetracker/security/advisories/GHSA-pgpx-rfvj-9g4f
3	Tested CSRF fix for custom ports - it's working, also removed unnecessary logging.	https://github.com/anuko/timetracker/commit/e3f8222ee308322942bcebcd86b78ecf19382563

Change Log

No	Changed Details	Date of change
1	[2021年12月22日] 掲載	Dec. 22, 2021, 3:04 p.m.