CVE-2024-54001 — Kanboard allows a persistent HTML injection site scripting in settings page date format

CVE-2024-54001

Kanboard allows a persistent HTML injection site scripting in settings page date format PUBLISHED

Description (CNA)

Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.

Affected (CNA)

Vendor / product	Versions
kanboard / kanboard	affected < 1.2.41

CWE

CWE-80

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrj

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.