CVE-2024-35224

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: May 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-352256.1Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access t CVE-2024-352267.3Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions tem CVE-2024-352277.5Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352285.5Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.s CVE-2024-352295.3ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern CVE-2024-35238.8A vulnerability classified as critical was found in Campcodes Online Event Management System 1.0. This vulnerability affects unknown code of CVE-2024-352305.3GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the we CVE-2024-352318.6rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5 CVE-2024-352323.7github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. acc CVE-2024-352346.1Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352356.7OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when sta CVE-2024-352364.8Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads