PT-2024-26388 · Unknown · Openproject+1

Seanmarpo · Published 2024-05-23 · Updated 2026-02-13 · CVE-2024-35224

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 13.4.2 OpenProject versions prior to 14.0.2 OpenProject versions prior to 14.1.0

Description The issue concerns OpenProject, a leading open source project management software, which utilizes tablesorter inside of the Cost Report feature. This dependency can lead to Stored XSS via {icon} substitution in table header values when misconfigured. The attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. The vulnerability can be exploited by storing javascript in the application itself via a ticket's attachment, bypassing the application's CSP policy to achieve Stored XSS.

Recommendations For versions prior to 13.4.2, update to version 13.4.2 or later. For versions prior to 14.0.2, update to version 14.0.2 or later. For versions prior to 14.1.0, update to version 14.1.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-35224

GHSA-H26C-J8WG-FRJC

Affected Products

Openproject

Tablesorter

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35224.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35224 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35224 · Vendor Advisory
• https://t.me/cvenotify/80862 · Telegram Post
• https://community.openproject.org/projects/openproject/work_packages/55198/relations · Note
• https://t.me/cveNotify/151946 · Telegram Post