In versions prior to 1.2.31 an authenticated user is able to perform a SQL injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations the code improperly uses the PicoDB library to update/insert new information. . MGASA-2024-0366 - Updated kanboard packages fix security vulnerability Publication date: 22 Nov 2024 URL: https://advisories.mageia.org/MGASA-2024-0366.html Type: security Affected Mageia releases: 9 CVE: CVE-2023-36813 In versions prior to 1.2.31 an authenticated user is able to perform a SQL injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations the code improperly uses the PicoDB library to update/insert new information. References: - https://bugs.mageia.org/show_bug.cgi?id=32113 - https://lists.debian.org/debian-security-announce/2023/msg00146.html - https://www.cve.org/CVERecord?id=CVE-2023-36813 SRPMS: - 9/core/kanboard-1.2.42-1.1.mga9 . The recent kanboard package updates tackle critical security flaws, specifically highlighting SQL injection risks, announced on 22 Nov 2024.. kanboard security, SQL injection fix, Mageia advisory, software vulnerability. . LinuxSecurity.com Team
Riccardo Bonafede discovered that the Kanboard project management software was susceptible to SQL injection. For the stable distribution (bookworm), this problem has been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5454-1
Get the latest Linux and open source security news straight to your inbox.