CVE-2023-33960

CVE-2023-33960 – OpenProject robots.txt exposure : OpenProject versions prior to 12.5.6 generate a publicly accessible robots.txt that lists identifiers for all public projects, even if the instance is set to login-restricted. This constitutes an information-disclosure vulnerability (no authentic...

CVE-2023-33960: Exposure of Sensitive Information to an Unauthorized Actor

OpenProject is web-based project management software. For any OpenProject installation, a robots.txt file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to...

OpenProject 安全漏洞

OpenProject is an open source Web-based project management software . The software features project planning, task management, bug tracking and cost budgeting. A security vulnerability exists in versions of OpenProject prior to 12.5.6 that stems from routing being publicly available...

CVE-2023-31140

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication 2FA device for an account, existing logged in sessions for that user account are not terminated. Likewise, if a...

Design/Logic Flaw

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication 2FA device for an account, existing logged in sessions for that user account are not terminated. Likewise, if a...

CVE-2023-31140

OpenProject Open Source PM software, affected in versions 7.4.0 through 12.5.4 where, after registering and confirming the first 2FA device (or when an admin creates a mobile 2FA device for a user), existing user sessions are not terminated. The root cause is a failure to terminate active session...

CVE-2023-31140 OpenProject user sessions not terminated after activation of 2FA

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication 2FA device for an account, existing logged in sessions for that user account are not terminated. Likewise, if a...

CVE-2023-31140 OpenProject user sessions not terminated after activation of 2FA

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication 2FA device for an account, existing logged in sessions for that user account are not terminated. Likewise, if a...

CVE-2023-31140 OpenProject user sessions not terminated after activation of 2FA

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication 2FA device for an account, existing logged in sessions for that user account are not terminated. Likewise, if a...

OpenProject 代码问题漏洞

OpenProject is an open source Web-based project management software . The software features project planning, task management, bug tracking and cost budgeting. A code issue vulnerability exists in OpenProject versions 7.4.0 through 12.5.4 that stems from an existing login session for a user accou...

CVE-2023-31140: Insufficient Session Expiration

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication 2FA device for an account, existing logged in sessions for that user account are not terminated. Likewise, if a...

PT-2023-23174 · Unknown · Openproject

Name of the Vulnerable Software and Affected Versions: OpenProject versions 7.4.0 through 12.5.3 Description: OpenProject is open source project management software. The issue arises when a user registers and confirms their first two-factor authentication 2FA device for an account, and existing...

The vulnerability of the OpenProject project management platform, related to the lack of measures taken to protect the website structure, allows attackers to carry out phishing attacks.

The vulnerability of the OpenProject project management platform lies in the lack of measures taken to protect the structure of the web page when processing the target=blank value without the rel noopener attribute. Exploiting this vulnerability could allow a malicious actor to carry out phishing...

CVE-2021-43830

OpenProject is a web-based project management software. OpenProject versions = 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in...

CVE-2021-43830

OpenProject is a web-based project management software. OpenProject versions = 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in...

CVE-2021-43830

OpenProject is a web-based project management software. OpenProject versions = 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in...

Sql injection

OpenProject is a web-based project management software. OpenProject versions = 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in...

CVE-2021-43830

OpenProject (web-based project management software) versions 12.0.0 and later are affected by a SQL injection in the budgets module. The vulnerability arises when reassigning work packages to a different budget, where input in the reassign_to_id parameter is insufficiently sanitized, and only aff...

CVE-2021-43830 SQL injection in OpenProject

OpenProject is a web-based project management software. OpenProject versions = 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in...

PT-2021-23962 · Unknown · Openproject

Name of the Vulnerable Software and Affected Versions: OpenProject versions 12.0.0 through 12.0.3 Description: OpenProject is a web-based project management software. The software is vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, t...