CVE-2023-33968

Katalog CVE

CVSS 5.4 · Medium EPSS 0,38%

Kerentanan Missing Authorization pada kanboard. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

5 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kanboard/kanboard/commit/c20be8f5fa26e54005a90c645e80b11481a65053 patch
• https://github.com/kanboard/kanboard/security/advisories/GHSA-gf8r-4p6m-v8vr exploit · advisory pihak ketiga