Description
Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.
INFO
Published Date :
2024-06-06T15:15:46.978Z
Last Modified :
2024-08-02T03:37:05.195Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2024-36399 vulnerability.
| Vendors | Products |
|---|---|
| Kanboard |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-36399.
