CVE-2017-15205

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://openwall.com/lists/oss-security/2017/10/04/9Mailing List, Third Party Advisory, VDB Entry
https://github.com/kanboard/kanboard/commit/7100f6de8a1f566e260b3e65312767e4cde112b1Patch, Third Party Advisory
https://kanboard.net/news/version-1.0.47Release Notes, Vendor Advisory
http://openwall.com/lists/oss-security/2017/10/04/9Mailing List, Third Party Advisory, VDB Entry
https://github.com/kanboard/kanboard/commit/7100f6de8a1f566e260b3e65312767e4cde112b1Patch, Third Party Advisory
https://kanboard.net/news/version-1.0.47Release Notes, Vendor Advisory

Timeline

Published: Oct 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-152064.3In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.CVE-2017-152074.3In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.CVE-2017-152084.3In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.CVE-2017-152094.3In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.CVE-2017-15216.1IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-s CVE-2017-152104.3In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another use CVE-2017-152114.3In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.CVE-2017-152124.3In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another u CVE-2017-152135.4Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via CVE-2017-152145.4Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileg CVE-2017-152156.1Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.CVE-2017-152166.1MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/aj