Lucene search

K
cve[email protected]CVE-2023-33956
HistoryJun 05, 2023 - 8:15 p.m.

CVE-2023-33956

2023-06-0520:15:09
CWE-639
CWE-200
web.nvd.nist.gov
18
kanboard
project management
kanban
security
vulnerability
idor
insecure direct object reference
cve-2023-33956
file access
information disclosure
privacy breach
data security

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.8%

Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application’s URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under /files directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application’s security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Vulners
NVD
Node
kanboardkanboardRange<1.2.30
VendorProductVersionCPE
kanboardkanboard*cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "vendor": "kanboard",
    "product": "kanboard",
    "versions": [
      {
        "version": "< 1.2.30",
        "status": "affected"
      }
    ]
  }
]

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.8%