CVE-2024-54001 — MEDIUM (5.5)

Vulnerability Description

Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Kanboard	Kanboard	1.2.40

Related Weaknesses (CWE)

CWE-79 CWE-80

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrjExploitVendor Advisory

FAQ

What is CVE-2024-54001?

CVE-2024-54001 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date...

How severe is CVE-2024-54001?

CVE-2024-54001 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-54001?

Check the references section above for vendor advisories and patch information. Affected products include: Kanboard Kanboard.