CVE-2017-12850

An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.

Kanboard versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

An SSRF vulnerability in Kanboard 1.2.52 and prior allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs, enabling access to internal network resources such as cloud instance metadata services or localhost services.

A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 564cc30) allows an authenticated user who is a member of at least one project to move (hide/corrupt) tasks from any other project, including private ones they have no access to. The issue is in the save() method of BoardAjaxController, which does not verify that the supplied task_id actually belongs to the attacker-supplied project_id.

A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 928c68a) allows authenticated users to delete other users' Remember Me sessions. The UserViewController::removeSession function fails to validate the session ID parameter before passing it to RememberMeSessionModel::remove.

Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31 authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality.

In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.

Kanboard is project management software that allows for an XSS attack by storing malicious JavaScript code in tasks. Users viewing such a task will be exposed to the XSS attack.

Kanboard, an open source project management software, has a missing access control vulnerability in versions prior to 1.2.30. This allows low-privileged users to create or transfer tasks to any project, even if they have not been invited or the project is personal.

Kanboard, a project management software, has an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.2.30. This allows any user to read files uploaded by other users, regardless of their privileges.