In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.
References
Link | Resource |
---|---|
http://openwall.com/lists/oss-security/2017/10/04/9 | Mailing List Third Party Advisory VDB Entry |
https://github.com/kanboard/kanboard/commit/074f6c104f3e49401ef0065540338fc2d4be79f0 | Patch Third Party Advisory |
https://github.com/kanboard/kanboard/commit/3e0f14ae2b0b5a44bd038a472f17eac75f538524 | Patch Third Party Advisory |
https://kanboard.net/news/version-1.0.47 | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2017-10-11 01:32
Updated : 2024-02-28 16:04
NVD link : CVE-2017-15203
Mitre link : CVE-2017-15203
CVE.ORG link : CVE-2017-15203
JSON object : View
Products Affected
kanboard
- kanboard
CWE
CWE-639
Authorization Bypass Through User-Controlled Key