{"id":"CVE-2017-15200","details":"In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.","modified":"2026-07-08T05:49:44.896811049Z","published":"2017-10-11T01:32:54.630Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:kanboard:kanboard:1.0.31:beta0:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.31:beta1:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.32:beta0:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.32:beta1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.0.31-beta0"},{"last_affected":"1.0.31-beta0"},{"introduced":"1.0.31-beta1"},{"last_affected":"1.0.31-beta1"},{"introduced":"1.0.32-beta0"},{"last_affected":"1.0.32-beta0"},{"introduced":"1.0.32-beta1"},{"last_affected":"1.0.32-beta1"}],"source":"CPE_STRING","vendor_product":"kanboard:kanboard"}]},"references":[{"type":"ADVISORY","url":"http://openwall.com/lists/oss-security/2017/10/04/9"},{"type":"ADVISORY","url":"https://kanboard.net/news/version-1.0.47"},{"type":"FIX","url":"https://github.com/kanboard/kanboard/commit/074f6c104f3e49401ef0065540338fc2d4be79f0"},{"type":"FIX","url":"https://github.com/kanboard/kanboard/commit/3e0f14ae2b0b5a44bd038a472f17eac75f538524"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kanboard/kanboard","events":[{"introduced":"c2f8e1c4360cbdd0c740b747d017034d97d8e053"},{"last_affected":"daccedbdab2709faca6faf8fcc3388f1f9eab07b"},{"fixed":"074f6c104f3e49401ef0065540338fc2d4be79f0"},{"fixed":"3e0f14ae2b0b5a44bd038a472f17eac75f538524"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"introduced":"1.0.1"},{"last_affected":"1.0.1"},{"introduced":"1.0.2"},{"last_affected":"1.0.2"},{"introduced":"1.0.3"},{"last_affected":"1.0.3"},{"introduced":"1.0.4"},{"last_affected":"1.0.4"},{"introduced":"1.0.5"},{"last_affected":"1.0.5"},{"introduced":"1.0.6"},{"last_affected":"1.0.6"},{"introduced":"1.0.7"},{"last_affected":"1.0.7"},{"introduced":"1.0.8"},{"last_affected":"1.0.8"},{"introduced":"1.0.9"},{"last_affected":"1.0.9"},{"introduced":"1.0.10"},{"last_affected":"1.0.10"},{"introduced":"1.0.11"},{"last_affected":"1.0.11"},{"introduced":"1.0.12"},{"last_affected":"1.0.12"},{"introduced":"1.0.13"},{"last_affected":"1.0.13"},{"introduced":"1.0.14"},{"last_affected":"1.0.14"},{"introduced":"1.0.15"},{"last_affected":"1.0.15"},{"introduced":"1.0.16"},{"last_affected":"1.0.16"},{"introduced":"1.0.17"},{"last_affected":"1.0.17"},{"introduced":"1.0.18"},{"last_affected":"1.0.18"},{"introduced":"1.0.19"},{"last_affected":"1.0.19"},{"introduced":"1.0.20"},{"last_affected":"1.0.20"},{"introduced":"1.0.21"},{"last_affected":"1.0.21"},{"introduced":"1.0.22"},{"last_affected":"1.0.22"},{"introduced":"1.0.23"},{"last_affected":"1.0.23"},{"introduced":"1.0.24"},{"last_affected":"1.0.24"},{"introduced":"1.0.25"},{"last_affected":"1.0.25"},{"introduced":"1.0.26"},{"last_affected":"1.0.26"},{"introduced":"1.0.27"},{"last_affected":"1.0.27"},{"introduced":"1.0.28"},{"last_affected":"1.0.28"},{"introduced":"1.0.29"},{"last_affected":"1.0.29"},{"introduced":"1.0.30"},{"last_affected":"1.0.30"},{"introduced":"1.0.31"},{"last_affected":"1.0.31"},{"introduced":"1.0.32"},{"last_affected":"1.0.32"},{"introduced":"1.0.33"},{"last_affected":"1.0.33"},{"introduced":"1.0.34"},{"last_affected":"1.0.34"},{"introduced":"1.0.35"},{"last_affected":"1.0.35"},{"introduced":"1.0.36"},{"last_affected":"1.0.36"},{"introduced":"1.0.37"},{"last_affected":"1.0.37"},{"introduced":"1.0.38"},{"last_affected":"1.0.38"},{"introduced":"1.0.39"},{"last_affected":"1.0.39"},{"introduced":"1.0.40"},{"last_affected":"1.0.40"},{"introduced":"1.0.41"},{"last_affected":"1.0.41"},{"introduced":"1.0.42"},{"last_affected":"1.0.42"},{"introduced":"1.0.43"},{"last_affected":"1.0.43"},{"introduced":"1.0.44"},{"last_affected":"1.0.44"},{"introduced":"1.0.45"},{"last_affected":"1.0.45"},{"introduced":"1.0.46"},{"last_affected":"1.0.46"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:kanboard:kanboard:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.4:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.5:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.8:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.9:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.10:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.11:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.12:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.14:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.15:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.16:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.17:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.18:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.19:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.20:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.21:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.22:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.23:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.24:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.25:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.26:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.27:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.28:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.29:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.30:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.31:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.32:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.33:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.34:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.35:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.36:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.37:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.38:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.39:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.40:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.41:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.42:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.43:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.44:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.45:*:*:*:*:*:*:*","cpe:2.3:a:kanboard:kanboard:1.0.46:*:*:*:*:*:*:*"]}}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.40","1.0.41","1.0.42","1.0.43","1.0.44","1.0.45","1.0.46","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","v1.0.46","v1.0.45","v1.0.44","v1.0.43","v1.0.42","v1.0.41","v1.0.40","v1.0.39","v1.0.38","v1.0.37","v1.0.36","v1.0.35","v1.0.34","v1.0.33","v1.0.32","v1.0.31","v1.0.30","v1.0.29","v1.0.28","v1.0.27","v1.0.26","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15200.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}