PT-2021-23962 · Unknown · Openproject

Bananabr + 1 · Published 2021-12-14 · Updated 2024-03-06 · CVE-2021-43830

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenProject versions 12.0.0 through 12.0.3

Description: OpenProject is a web-based project management software. The software is vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget insufficiently sanitizes user input in the reassign to id parameter.

Recommendations: For OpenProject versions 12.0.0 through 12.0.3, upgrade to at least version 12.0.4 to resolve the issue. If you are unable to upgrade in a timely fashion, consider applying a patch to fix the vulnerability. As a temporary workaround, consider restricting access to the budgets module for users with the "Edit budgets" permission until a patch is applied. Avoid using the reassign to id parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-OPENPROJECT-2021-43830

CVE-2021-43830

GHSA-F565-3WHR-6M96

Affected Products

Openproject

References · 9

• https://github.com/opf/openproject/pull/9983 · Patch
• https://github.com/opf/openproject/pull/9983.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43830 · Security Note
• https://osv.dev/vulnerability/BIT-openproject-2021-43830 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43830 · Vendor Advisory
• https://github.com/opf/openproject/releases/tag/v12.0.4 · Note
• https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96 · Note
• https://github.com/opf/openproject · Note
• https://t.me/cibsecurity/33975 · Telegram Post