PT-2023-24601 · Unknown · Openproject

Published 2023-06-01 · Updated 2026-01-15 · CVE-2023-33960

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 12.5.6

Description OpenProject is web-based project management software. A robots.txt file is generated to denote which routes shall or shall not be accessed by crawlers, containing project identifiers of all public projects in the instance. Even if the entire instance is marked as Login required, the /robots.txt route remains publicly available prior to version 12.5.6.

Recommendations For versions prior to 12.5.6, update to version 12.5.6 to resolve the issue. Alternatively, for versions greater than 10.0, download and apply the provided patchfile. As a temporary workaround, consider marking public projects as non-public and granting membership to those who need access to the project.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-319

CWE-200

Related Identifiers

BIT-OPENPROJECT-2023-33960

CVE-2023-33960

GHSA-XJFC-FQM3-95Q8

Affected Products

Openproject

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33960.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-xjfc-fqm3-95q8 · Vendor Advisory
• https://github.com/opf/openproject/pull/12708 · Patch
• https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/12708.patch · Patch
• https://osv.dev/vulnerability/BIT-openproject-2023-33960 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33960 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33960 · Vendor Advisory
• https://github.com/opf/openproject/releases/tag/v12.5.6 · Note
• https://twitter.com/pdnuclei_bot/status/2011694879639007671 · Twitter Post
• https://community.openproject.org/wp/48324 · Note
• https://t.me/cvenotify/51566 · Telegram Post