CVE-2024-35224

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-35224
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35224.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-35224
Aliases
  • GHSA-h26c-j8wg-frjc
Published
2024-05-23T12:53:04Z
Modified
2025-11-04T20:23:19.014703Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Stored Cross-Site Scripting (XSS) in OpenProject
Details

OpenProject is the leading open source project management software. OpenProject utilizes tablesorter inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via {icon} substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.

Database specific 
{
    "cwe_ids": [
        "CWE-80"
    ]
}
References

Affected packages

Git / github.com/opf/openproject

Affected ranges

Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
f8d6a196a180155d69998d73f796fa1f177b16bb
Fixed
540f21f479f0c76e08e7d9e335ba41490c6eb4a2
Database specific 
{
    "versions": [
        {
            "introduced": "13.4.0"
        },
        {
            "fixed": "13.4.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4e5f609f07c05a82f62e66766a1d841a6121205d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "14.1.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
aa7a72a913cb619b3f976ff5f411ef7af97b6caa
Fixed
462d76a2a9ffe83f2cbee74bdbe3e756cfd6a646
Database specific 
{
    "versions": [
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "14.0.2"
        }
    ]
}

Affected versions

11.*

11.2.1

2.*

2.4.0

release/3.*

release/3.0.0

Other

sprint/2014_08
sprint/2014_09
sprint/2014_10
sprint/2014_11
sprint/2014_12
sprint/2014_13
sprint/2014_16
sprint/2014_18
sprint/2015_01
sprint/2015_02
sprint/2015_03
sprint/2015_04

v10.*

v10.5

v11.*

v11.0.0
v11.0.1
v11.0.2
v11.0.3
v11.0.4
v11.1.0
v11.1.1
v11.1.2
v11.1.3
v11.1.4
v11.2.0
v11.2.1
v11.2.2
v11.2.3
v11.2.4

v13.*

v13.4.0
v13.4.1

v14.*

v14.0.0
v14.0.1
v14.0.2

v3.*

v3.0.0
v3.0.1
v3.0.11
v3.0.12
v3.0.13
v3.0.8

v4.*

v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.1.0
v4.1.0-beta
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.2.7
v4.2.8
v4.2.9

v5.*

v5.0.0
v5.0.1
v5.0.10
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9

v9.*

v9.0.0-pre
v9.0.2-pre