{"id":"CVE-2017-15195","details":"In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user.","modified":"2026-10-20T10:48:13.844002468Z","published":"2017-10-11T01:32:54.270Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"1.0.31-beta0"},{"last_affected":"1.0.31-beta0"},{"introduced":"1.0.31-beta1"},{"last_affected":"1.0.31-beta1"},{"introduced":"1.0.32-beta0"},{"last_affected":"1.0.32-beta0"},{"introduced":"1.0.32-beta1"},{"last_affected":"1.0.32-beta1"}],"source":"CPE_STRING"}],"vendor_product":"kanboard:kanboard","cpes":["cpe:2.3:a:kanboard:kanboard:1.0.31:beta0:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.31:beta1:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.32:beta0:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.32:beta1:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"http://openwall.com/lists/oss-security/2017/10/04/9"},{"type":"ADVISORY","url":"https://kanboard.net/news/version-1.0.47"},{"type":"FIX","url":"https://github.com/kanboard/kanboard/commit/074f6c104f3e49401ef0065540338fc2d4be79f0"},{"type":"FIX","url":"https://github.com/kanboard/kanboard/commit/3e0f14ae2b0b5a44bd038a472f17eac75f538524"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kanboard/kanboard","events":[{"introduced":"c2f8e1c4360cbdd0c740b747d017034d97d8e053"},{"last_affected":"daccedbdab2709faca6faf8fcc3388f1f9eab07b"},{"fixed":"074f6c104f3e49401ef0065540338fc2d4be79f0"},{"fixed":"3e0f14ae2b0b5a44bd038a472f17eac75f538524"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.0:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.1:*:*:*:*:*:*:*","range":[{"introduced":"1.0.1"},{"last_affected":"1.0.1"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.0.2"},{"last_affected":"1.0.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.2:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.3:*:*:*:*:*:*:*","range":[{"introduced":"1.0.3"},{"last_affected":"1.0.3"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.4:*:*:*:*:*:*:*","range":[{"introduced":"1.0.4"},{"last_affected":"1.0.4"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.0.5"},{"last_affected":"1.0.5"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.5:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.6:*:*:*:*:*:*:*","range":[{"introduced":"1.0.6"},{"last_affected":"1.0.6"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.7:*:*:*:*:*:*:*","range":[{"introduced":"1.0.7"},{"last_affected":"1.0.7"}]},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.8:*:*:*:*:*:*:*","range":[{"introduced":"1.0.8"},{"last_affected":"1.0.8"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.0.9"},{"last_affected":"1.0.9"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.9:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.10:*:*:*:*:*:*:*","range":[{"introduced":"1.0.10"},{"last_affected":"1.0.10"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.11:*:*:*:*:*:*:*","range":[{"introduced":"1.0.11"},{"last_affected":"1.0.11"}]},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.12:*:*:*:*:*:*:*","range":[{"introduced":"1.0.12"},{"last_affected":"1.0.12"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.13:*:*:*:*:*:*:*","range":[{"introduced":"1.0.13"},{"last_affected":"1.0.13"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.14:*:*:*:*:*:*:*","range":[{"introduced":"1.0.14"},{"last_affected":"1.0.14"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.15:*:*:*:*:*:*:*","range":[{"introduced":"1.0.15"},{"last_affected":"1.0.15"}]},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.16:*:*:*:*:*:*:*","range":[{"introduced":"1.0.16"},{"last_affected":"1.0.16"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.17:*:*:*:*:*:*:*","range":[{"introduced":"1.0.17"},{"last_affected":"1.0.17"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.0.18"},{"last_affected":"1.0.18"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.18:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.19:*:*:*:*:*:*:*","range":[{"introduced":"1.0.19"},{"last_affected":"1.0.19"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.20:*:*:*:*:*:*:*","range":[{"introduced":"1.0.20"},{"last_affected":"1.0.20"}]},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.21:*:*:*:*:*:*:*","range":[{"introduced":"1.0.21"},{"last_affected":"1.0.21"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.22:*:*:*:*:*:*:*","range":[{"introduced":"1.0.22"},{"last_affected":"1.0.22"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.23:*:*:*:*:*:*:*","range":[{"introduced":"1.0.23"},{"last_affected":"1.0.23"}]},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.24:*:*:*:*:*:*:*","range":[{"introduced":"1.0.24"},{"last_affected":"1.0.24"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.0.25"},{"last_affected":"1.0.25"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.25:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.0.26"},{"last_affected":"1.0.26"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.26:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.0.27"},{"last_affected":"1.0.27"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.27:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.28:*:*:*:*:*:*:*","range":[{"introduced":"1.0.28"},{"last_affected":"1.0.28"}]},{"range":[{"introduced":"1.0.29"},{"last_affected":"1.0.29"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.29:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.0.30"},{"last_affected":"1.0.30"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.30:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.0.31"},{"last_affected":"1.0.31"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.31:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.32:*:*:*:*:*:*:*","range":[{"introduced":"1.0.32"},{"last_affected":"1.0.32"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.0.33"},{"last_affected":"1.0.33"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.33:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.34:*:*:*:*:*:*:*","range":[{"introduced":"1.0.34"},{"last_affected":"1.0.34"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.35:*:*:*:*:*:*:*","range":[{"introduced":"1.0.35"},{"last_affected":"1.0.35"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.36:*:*:*:*:*:*:*","range":[{"introduced":"1.0.36"},{"last_affected":"1.0.36"}]},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.37:*:*:*:*:*:*:*","range":[{"introduced":"1.0.37"},{"last_affected":"1.0.37"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.38:*:*:*:*:*:*:*","range":[{"introduced":"1.0.38"},{"last_affected":"1.0.38"}]},{"range":[{"introduced":"1.0.39"},{"last_affected":"1.0.39"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.39:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.0.40"},{"last_affected":"1.0.40"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.40:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.41:*:*:*:*:*:*:*","range":[{"introduced":"1.0.41"},{"last_affected":"1.0.41"}]},{"range":[{"introduced":"1.0.42"},{"last_affected":"1.0.42"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.42:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.43:*:*:*:*:*:*:*","range":[{"introduced":"1.0.43"},{"last_affected":"1.0.43"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.0.44"},{"last_affected":"1.0.44"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:kanboard:kanboard:1.0.44:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.45:*:*:*:*:*:*:*","range":[{"introduced":"1.0.45"},{"last_affected":"1.0.45"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:kanboard:kanboard:1.0.46:*:*:*:*:*:*:*","range":[{"introduced":"1.0.46"},{"last_affected":"1.0.46"}],"source":"CPE_STRING"},{"range":[{"fixed":"074f6c104f3e49401ef0065540338fc2d4be79f0"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"3e0f14ae2b0b5a44bd038a472f17eac75f538524"}]}]}}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.40","1.0.41","1.0.42","1.0.43","1.0.44","1.0.45","1.0.46","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","v1.0.46","v1.0.45","v1.0.44","v1.0.43","v1.0.42","v1.0.41","v1.0.40","v1.0.39","v1.0.38","v1.0.37","v1.0.36","v1.0.35","v1.0.34","v1.0.33","v1.0.32","v1.0.31","v1.0.30","v1.0.29","v1.0.28","v1.0.27","v1.0.26","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15195.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}