CVE-2021-21352

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing).

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Mar 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-213539.0Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control th CVE-2021-213546.1Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox CVE-2021-213558.6TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack o CVE-2021-213578.3TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper in CVE-2021-213585.4TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Fo CVE-2021-213597.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-CVE-2021-21369.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-213605.3Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.G CVE-2021-213616.5The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system env CVE-2021-213626.5MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO befo CVE-2021-213637.0swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in CVE-2021-213645.5swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in