CVE-2023-33969 - CVE House

Back to Database

Status published Medium CVE-2023-33969

Stored Cross site scripting in the Task External Link Functionality in Kanboard

6.4 CVSS

Vulnerability Description

Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-33969

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from kanboard

View All →

Kanboard Path Traversal in File Write via Task File Upload Api

Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass

Kanboard Password Reset Poisoning via Host Header Injection

Kanboard has stored Cross-site Scripting vulnerability in project name

Affected Vendor

kanboard

View all reports →

Affected Software

kanboard

Vulnerable Versions:

< 1.2.30

Timeline

Official Publish: June 5th, 2023

Last Modified: January 8th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement