PT-2023-24608 · Kanboard · Kanboard

Castilho101 · Published 2023-06-05 · Updated 2026-02-13 · CVE-2023-33968

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.30

Description Kanboard is project management software based on the Kanban methodology. A missing access control allows a user with limited privileges to create or move tasks to any project, even those they haven’t been invited to or are personal. The issue affects the Duplicate to project and Move to project features, which use the checkDestinationProjectValues() function.

Recommendations Upgrade to version 1.2.30 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-33968

GHSA-GF8R-4P6M-V8VR

Affected Products

Kanboard

References · 10

• 🔥 https://github.com/kanboard/kanboard/security/advisories/GHSA-gf8r-4p6m-v8vr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33968.json · Exploit
• https://github.com/kanboard/kanboard/commit/c20be8f5fa26e54005a90c645e80b11481a65053 · Patch
• https://osv.dev/vulnerability/CVE-2023-33968 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-33968 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-33968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33968 · Security Note
• https://twitter.com/CVEnew/status/2022337897190355279 · Twitter Post
• https://t.me/CVEtracker/44621 · Telegram Post
• https://t.me/cvenotify/51790 · Telegram Post