CVE-2024-35224 Stored Cross-Site Scripting (XSS) in OpenProject
Stored XSS in OpenProject allows attackers with specific permissions to execute scripts, potentially escalating privileges to System Admin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-35224?
CVE-2024-35224 is a high-severity cross-site scripting vulnerability in opf openproject, published on 23 May 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.
Weakness: CWE-80
Which versions are affected by CVE-2024-35224?
It affects 1 product.
Products include Openproject Openproject.
How do I fix CVE-2024-35224?
No fix has been published for CVE-2024-35224 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-35224 being exploited?
There is no known exploitation of CVE-2024-35224 in the wild and no public exploit code.
Other vulnerabilities in opf openproject
- CVE-2026-34717 OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
- CVE-2026-25763 Command Injection on OpenProject repositories leads to Remote Code Execution
- CVE-2026-24685 OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
- CVE-2026-32698 OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution
- CVE-2026-32703 OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy
Sources
Also known as GHSA-h26c-j8wg-frjc.