CVE-2021-43830 Information

Description

OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the \Edit budgets\ permission the request to reassign work packages to another budget unsufficiently sanitizes user input in the reassign_to_id parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you’re upgrading from an older version ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/opf/openproject/pull/9983 https://github.com/opf/openproject/releases/tag/v12.0.4 https://github.com/opf/openproject/pull/9983.patch https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8