CVE-2021-43830
Description
OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the reassign_to_id parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*range: >=12.0.0,<12.0.4
- (no CPE)range: >=12.0.0, <12.0.4
- (no CPE)range: >= 12.0.0, < 12.0.4
Patches
Vulnerability mechanics
References
4- github.com/opf/openproject/pull/9983nvdPatchThird Party Advisory
- github.com/opf/openproject/pull/9983.patchnvdPatchThird Party Advisory
- github.com/opf/openproject/releases/tag/v12.0.4nvdRelease NotesThird Party Advisory
- github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96nvdThird Party Advisory
News mentions
0No linked articles in our index yet.