Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

OpenProject

14.1.0

14.0.2

13.4.2

Source

security-advisories@github.com

CVE-2024-35224 details

Published : May 23, 2024, 1:15 p.m.
Last Modified : May 23, 2024, 1:15 p.m.

Description

OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.

CVSS Score

1	2	3	4	5	6	7.6	8	9	10

Weakness

Weakness	Name	Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

Base Score

7.6

Exploitability Score

Impact Score

Base Severity