Description
Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kanboard kanboard
Default version status: unaffected
0 to ≤ 1.2.52affected928c68aa2b7c00092dd71084d329b912e229f3d1unaffected
pkg:github/kanboard/kanboardReferences
- https://github.com/kanboard/kanboard/issues/5829 ↗
- https://github.com/kanboard/kanboard/pull/5831 ↗
- https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1 ↗
- https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent-login-sessions-via-unvalidated-session-id ↗