Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.
References
Configurations
History
21 Nov 2024, 08:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/wekan/wekan/blob/master/CHANGELOG.md - Release Notes | |
| References | () https://github.com/wekan/wekan/commit/47ac33d6c234359c31d9b5eae49ed3e793907279 - Patch |
31 May 2023, 13:38
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* | |
| First Time |
Wekan Project
Wekan Project wekan |
|
| CWE | CWE-79 | |
| References | (MISC) https://github.com/wekan/wekan/blob/master/CHANGELOG.md - Release Notes | |
| References | (MISC) https://github.com/wekan/wekan/commit/47ac33d6c234359c31d9b5eae49ed3e793907279 - Patch |
22 May 2023, 13:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-22 13:15
Updated : 2025-01-28 17:15
NVD link : CVE-2023-31779
Mitre link : CVE-2023-31779
CVE.ORG link : CVE-2023-31779
JSON object : View
Products Affected
wekan_project
- wekan
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')