FKIE_CVE-2024-35224

Vulnerability from fkie_nvd - Published: 2024-05-23 13:15 - Updated: 2024-11-21 09:19
Severity ?
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Summary
OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.
References
security-advisories@github.comhttps://community.openproject.org/projects/openproject/work_packages/55198/relations
security-advisories@github.comhttps://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc
af854a3a-2127-422b-91ae-364da2661108https://community.openproject.org/projects/openproject/work_packages/55198/relations
af854a3a-2127-422b-91ae-364da2661108https://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions \"Edit work packages\" as well as \"Add attachments\". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket\u0027s attachment, you can store javascript in the application itself and bypass the application\u0027s CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.\n"
    },
    {
      "lang": "es",
      "value": "OpenProject es el software l\u00edder de gesti\u00f3n de proyectos de c\u00f3digo abierto. OpenProject utiliza \"tablesorter\" dentro de la funci\u00f3n Informe de costos. Esta dependencia, cuando est\u00e1 mal configurada, puede provocar que se almacene XSS mediante la sustituci\u00f3n de `{icon}` en los valores del encabezado de la tabla. Este ataque requiere los permisos \"Editar paquetes de trabajo\", as\u00ed como \"Agregar archivos adjuntos\". Un administrador de proyecto podr\u00eda intentar aumentar sus privilegios enviando este XSS a un administrador del sistema. De lo contrario, si se requiere un administrador del sistema completo, este ataque tendr\u00e1 un impacto significativamente menor. Al utilizar el archivo adjunto de un ticket, puede almacenar javascript en la propia aplicaci\u00f3n y omitir la pol\u00edtica CSP de la aplicaci\u00f3n para lograr Stored XSS. Esta vulnerabilidad ha sido parcheada en las versiones 14.1.0, 14.0.2 y 13.4.2."
    }
  ],
  "id": "CVE-2024-35224",
  "lastModified": "2024-11-21T09:19:58.373",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-23T13:15:09.380",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://community.openproject.org/projects/openproject/work_packages/55198/relations"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://community.openproject.org/projects/openproject/work_packages/55198/relations"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.