Description
A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. Patch name: 545566f5663545d16174e0f2399f231aa693ab6e. It is advisable to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WeKan | 8.0, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8, 8.9, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20 | 8.21 |
References
- VDB-344486 | WeKan REST Endpoint boards.js BoardTitleRESTBleed access control vdb-entry technical-description
- VDB-344486 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #742680 | Wekan <8.21 Improper access control in REST endpoint (CWE-284) third-party-advisory
- https://github.com/wekan/wekan/commit/545566f5663545d16174e0f2399f231aa693ab6e patch
- https://github.com/wekan/wekan/releases/tag/v8.21 patch
- https://github.com/wekan/wekan/ product