Description
Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
taiga taiga-back
Default version status: unaffected
0 to < 6.10.2affected
pkg:github/taigaio/taiga-backReferences
- https://github.com/taigaio/taiga-back/releases/tag/6.10.2 ↗
- https://github.com/taigaio/taiga-back/issues/244 ↗
- https://github.com/taigaio/taiga-back/pull/245 ↗
- https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9 ↗
- https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets ↗