CVE-2021-43830

    Dashboard / Vulnerabilities / CVE-2021-43830

    CVE-2021-43830

    Published: 14 Dec 2021Last Modified: 7 Aug 2026

    Summary:

    Details: OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch

    References: https://github.com/opf/openproject/releases/tag/v12.0.4, https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96, https://github.com/opf/openproject/pull/9983, https://github.com/opf/openproject/pull/9983.patch

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ad3df7f724e812a4f3804f59454984fcf15f79b3
    Fixed -aa0813030c9f9654e808f61b3f914d2b2e6086a5

    Affected versions

    v12.0.3
    v12.0.2
    v12.0.1
    v12.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-43830 | CVE-DB