{"id":"CVE-2017-11667","details":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.","modified":"2026-08-07T14:49:15.532149Z","published":"2017-07-26T20:29:00.223Z","references":[{"type":"ADVISORY","url":"https://www.openproject.org/openproject-6-1-6-released-security-fix/"},{"type":"ADVISORY","url":"https://www.openproject.org/openproject-7-0-3-released/"},{"type":"FIX","url":"https://github.com/opf/openproject/commit/0fdd7578909d2ec50abc275fc4962e99566437ee"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opf/openproject","events":[{"introduced":"0"},{"last_affected":"0f967d8f6163a0b2b8f0fb913c132e4f809a4b17"},{"introduced":"e1c41c93bba8f92959cddf443f06bbe3ad769129"},{"last_affected":"13cdf64b630e5d8d13e31f922c3185cd19c83943"},{"fixed":"0fdd7578909d2ec50abc275fc4962e99566437ee"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"6.1.5"},{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.0.1"},{"last_affected":"7.0.1"},{"introduced":"7.0.2"},{"last_affected":"7.0.2"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*","cpe:2.3:a:openproject:openproject:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:openproject:openproject:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:openproject:openproject:7.0.2:*:*:*:*:*:*:*"]}}],"versions":["7.0.0","7.0.1","7.0.2","v7.0.2","v7.0.1","v7.0.0","v6.1.5","v6.1.4","v6.1.3","v6.1.2","v6.1.1","v6.1.0","v6.0.5","v6.0.4","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v5.0.4","sprint/2015_04","sprint/2015_03","sprint/2015_02","sprint/2015_01","sprint/2014_18","sprint/2014_16","sprint/2014_13","sprint/2014_12","sprint/2014_11","sprint/2014_10","sprint/2014_09","sprint/2014_08","2.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11667.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}