Vulnerability Description
Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kanboard | Kanboard | < 1.2.29 |
Related Weaknesses (CWE)
References
- https://github.com/kanboard/kanboard/commit/26b6eebb78d4306e48b836a58f7c386251aaPatch
- https://github.com/kanboard/kanboard/commit/c9c187206700030c43493b80fd599b4d096cPatch
- https://github.com/kanboard/kanboard/security/advisories/GHSA-hjmw-gm82-r4gvVendor Advisory
- https://github.com/kanboard/kanboard/commit/26b6eebb78d4306e48b836a58f7c386251aaPatch
- https://github.com/kanboard/kanboard/commit/c9c187206700030c43493b80fd599b4d096cPatch
- https://github.com/kanboard/kanboard/security/advisories/GHSA-hjmw-gm82-r4gvVendor Advisory
FAQ
What is CVE-2023-32685?
CVE-2023-32685 is a vulnerability with a CVSS score of 4.4 (MEDIUM). Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inje...
How severe is CVE-2023-32685?
CVE-2023-32685 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-32685?
Check the references section above for vendor advisories and patch information. Affected products include: Kanboard Kanboard.