CVE-2024-51748

Kanboard path traversal

9.1 CRITICALEPSS 0.94%

Published11 Nov 2024

Description

Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting `application_language` in the `settings` table. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, has control over the filepath, which is loaded. Exploiting this vulnerability has one constraint: the attacker must be able to place a file (called translations.php) on the system. However, this is not impossible, think of anonymous FTP server or another application that allows uploading files. Once the attacker has placed its file with the actual php code as the payload, the attacker can craft a sqlite db settings, which uses path traversal to point to the directory, where the `translations.php` file is stored. Then gaining code execution after importing the crafted sqlite.db. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredHigh

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

Kanboard< 1.2.42

Remediation

Fixed in

Kanboard≥ 1.2.42

Frequently asked

Is CVE-2024-51748 being actively exploited?

CVE-2024-51748 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.94%.

How severe is CVE-2024-51748?

CVE-2024-51748 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.94% probability of exploitation.

Which products are affected by CVE-2024-51748?

Affected products include Kanboard.

How do I fix CVE-2024-51748?

Upgrade affected software to a fixed version, for example Kanboard 1.2.42 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-51748 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.