Vulnerability · Published Dec 14, 2021 · Assigned by GitHub_M

CVE-2021-43830SQL injection in OpenProject

High 7.4

In plain English

A high-severity SQL injection in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)1.0%top 38.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	>= 12.0.0, < 12.0.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References

https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96 x_refsource_CONFIRM
https://github.com/opf/openproject/pull/9983 x_refsource_MISC
https://github.com/opf/openproject/pull/9983.patch x_refsource_MISC
https://github.com/opf/openproject/releases/tag/v12.0.4 x_refsource_MISC