CVE-2024-36399

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-36399
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-36399.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-36399
Aliases
  • GHSA-x8v7-3ghx-65cv
Downstream
Published
2024-06-06T15:15:46Z
Modified
2025-10-20T20:26:46.042975Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Kanboard affected by Project Takeover via IDOR in ProjectPermissionController
Details

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter projectid does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-285",
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/kanboard/kanboard

Affected ranges

Type
GIT
Repo
https://github.com/kanboard/kanboard
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b6703688aac8187f5ea4d4d704fc7afeeffeafa7

Affected versions

v1.*

v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.20
v1.0.21
v1.0.22
v1.0.23
v1.0.24
v1.0.25
v1.0.26
v1.0.27
v1.0.28
v1.0.29
v1.0.3
v1.0.30
v1.0.31
v1.0.32
v1.0.33
v1.0.34
v1.0.35
v1.0.36
v1.0.37
v1.0.38
v1.0.39
v1.0.4
v1.0.40
v1.0.41
v1.0.42
v1.0.43
v1.0.44
v1.0.45
v1.0.46
v1.0.47
v1.0.48
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.25
v1.2.26
v1.2.27
v1.2.28
v1.2.29
v1.2.3
v1.2.30
v1.2.31
v1.2.32
v1.2.33
v1.2.34
v1.2.35
v1.2.36
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9