CVE-2024-54001

Katalog CVE

CVSS 5.5 · Medium EPSS 0,39%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada kanboard. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.

Rincian

Terbit di NVD

5 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrj exploit · advisory vendor