CVE-2023-33960

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada openproject. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available. Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.

Rincian

Terbit di NVD

1 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opf/openproject/security/advisories/GHSA-xjfc-fqm3-95q8 advisory vendor
• https://github.com/opf/openproject/pull/12708 patch
• https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/12708.patch mailing list · patch
• https://community.openproject.org/wp/48324 permissions required
• https://github.com/opf/openproject/releases/tag/v12.5.6 release notes