Headline
CVE-2023-36813: Release Kanboard 1.2.31 · kanboard/kanboard
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.
- Releases
- v1.2.31
Security Fixes:
- CVE-2023-36813: Avoid potential SQL injections without breaking compatibility with plugins
Other fixes and updates:
- Run tests with PHP 8 on GitHub Actions
- Bump Symfony dependencies
- Update Composer dependencies to be able to run tests with PHP 8.2
- Add /usr/bin/php symlink in the Docker image
- Replace usage of at() matcher with alternatives in unit tests
- Adjust plugin directory test case to work on released versions
- Fix incorrect background dynamic property in captcha library
- Update translations
Related news
Debian Security Advisory 5454-1
Debian Linux Security Advisory 5454-1 - Riccardo Bonafede discovered that the Kanboard project management software was susceptible to SQL injection.