CVE-2023-36813 Kanboard Authenticated SQL Injections vulnerability

2023-07-0521:05:53

CWE-89

GitHub_M

www.cve.org

kanboard

sql injection

vulnerability

picodb

privilege escalation

confidentiality

fix

version 1.2.31

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.0%

JSON

Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.

CNA Affected

[
  {
    "vendor": "kanboard",
    "product": "kanboard",
    "versions": [
      {
        "version": "< 1.2.31",
        "status": "affected"
      }
    ]
  }
]