CVE-2023-33970CWE-862

Missing access control in internal task links feature in Kanboard

Medium · published June 5, 2023

CVSS v3.1
5.4
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-06-05T19:54Z
EPSS history
Timeline
  • 05 JUN 19:54Z
    Missing access control in internal task links feature in Kanboard
    cvelistv5