CVE-2023-33968CWE-862

Missing Access Control allows User to move and duplicate tasks in Kanboard

Medium · published June 5, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-06-05T19:49Z
EPSS history
Timeline
  • 05 JUN 19:49Z
    Missing Access Control allows User to move and duplicate tasks in Kanboard
    cvelistv5