Vulnerability · Published Jun 6, 2024 · Assigned by GitHub_M

CVE-2024-36399Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

High 8.2

In plain English

A high-severity improper access control in kanboard from kanboard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 70.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	kanboard	1.2.44+ds-1	DEBIAN-CVE-2024-36399

Affected products (as reported)

Vendor	Product	Versions
kanboard	kanboard	1.2.37

Weakness: CWE-284, CWE-285, CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-x8v7-3ghx-65cv x_refsource_CONFIRM
https://github.com/kanboard/kanboard/commit/b6703688aac8187f5ea4d4d704fc7afeeffeafa7 x_refsource_MISC