CVE-2023-33970
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.
Risk Assessment
This vulnerability may lead to the leakage of private or critical information if such data is present in the title of a project or task. Organizations should be aware of the risks associated with the disclosure of sensitive information.
Recommendation
It is recommended to upgrade to version 1.2.30, where the issue has been addressed. There are no known workarounds for this vulnerability.
Original NVD description (English source)
Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.