Read the docs
TI-2021-04452 Aliases CVE-2021-21352

Predictable tokens used for password resets

Priority MEDIUM 42CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing).

Why it matters now

EPSS 0.01545 75th percentileScored 2026-11-07
Fix Fixed timetracker (anuko): 1.19.24.5415

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
anukotimetrackerbefore 1.19.24.54151.19.24.5415Patch availableCNA
  • timetracker Vendoranuko Affected before 1.19.24.5415 Fixed in 1.19.24.5415 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*before 1.19.24.5415Vulnerableanuko
  • cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:* Versions before 1.19.24.5415 Vulnerable ·anuko

Remediation

  • Fix · CNA timetracker (anuko) Fixed in 1.19.24.5415

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21352

References

Patch 1

Advisory 2

  • TI-2022-08522 SQL injection in anuko timetracker CVSS 3.1HIGH 8.8
  • TI-2020-16665 In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't… CVSS 3.1CRITICAL 9.8
  • TI-2023-15602 SQL Injection Vulnerability in anuko timetracker CVSS 3.1CRITICAL 9.8
  • TI-2023-15600 Time Tracker has Blind SQL Injection Vulnerability in Reports CVSS 3.1CRITICAL 9.8
  • TI-2020-12027 CSV injection in Anuko Time Tracker CVSS 3.1HIGH 8.7
  • TI-2020-16666 Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which… CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences