CVE-2023-33960

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available.

Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-339615.4Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can iCVE-2023-339626.1JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowiCVE-2023-339639.8DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataCVE-2023-339647.5mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miCVE-2023-339658.8Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may foolCVE-2023-339669.8Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `noCVE-2023-339679.8EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PosCVE-2023-339685.4Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missinCVE-2023-339695.4Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an atCVE-2023-33976.3A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw aCVE-2023-339706.5Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access conCVE-2023-339715.4Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probabl
CVE-2023-33960: High severity, CVSS 7.5 | Vulnix