CVE-2024-54001 Kanboard allows a persistent HTML injection site scripting in settings page date format
Attackers can inject persistent HTML or JavaScript into Kanboard settings, potentially leading to XSS and account takeover if CSP is bypassed.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-54001?
CVE-2024-54001 is a medium-severity cross-site scripting vulnerability in kanboard, published on 5 Dec 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.
Which versions are affected by CVE-2024-54001?
It affects 1 product.
Products include Kanboard Kanboard.
How do I fix CVE-2024-54001?
No fix has been published for CVE-2024-54001 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-54001 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-54001 exists.
Other vulnerabilities in kanboard
- CVE-2026-21881 Kanboard is Vulnerable to Reverse Proxy Authentication Bypass
- CVE-2025-55010 Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events
- CVE-2024-51747 Arbitrary File Read and Delete in kanboard
- CVE-2024-51748 Remote code execution through language setting in kanboard
- CVE-2017-12850 Business logic in n/a
Sources
Also known as GHSA-4vvp-jf72-chrj.