CVE-2021-21352

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker versions prior to 1.19.24.5415

Description The issue affects the password reset feature, where tokens are based on system time, making them predictable. This predictability allows for brute force attacks to guess user tokens, potentially leading to unauthorized password changes, including those of system administrators.

Recommendations For versions prior to 1.19.24.5415, update to version 1.19.24.5415 or later to use more secure tokens and limit the window for brute force token guessing. As a temporary workaround, consider restricting access to the password reset feature until the update is applied.