CVE - CVE-2023-33968

CVE-ID
CVE-2023-33968	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/kanboard/kanboard/commit/c20be8f5fa26e54005a90c645e80b11481a65053 URL:https://github.com/kanboard/kanboard/commit/c20be8f5fa26e54005a90c645e80b11481a65053 MISC:https://github.com/kanboard/kanboard/security/advisories/GHSA-gf8r-4p6m-v8vr URL:https://github.com/kanboard/kanboard/security/advisories/GHSA-gf8r-4p6m-v8vr
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20230524	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230524)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)