Stored XSS in Cost Report feature via {icon} substitution

CVE-2024-35224

What is CVE-2024-35224?

The OpenProject project management software is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability caused by a misconfigured tablesorter dependency within its Cost Report feature. This vulnerability allows an attacker with permissions to 'Edit work packages' and 'Add attachments' to execute JavaScript code within the application. By exploiting this weakness, attackers could potentially escalate their privileges, targeting system administrators with malicious payloads delivered via attachments. However, a system administrator is required for a successful exploitation, which limits the attack's overall impact. Versions 14.1.0, 14.0.2, and 13.4.2 have been patched to resolve this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References