{"api_version":"1","generated_at":"2026-04-23T08:39:34+00:00","cve":"CVE-2021-43830","urls":{"html":"https://cve.report/CVE-2021-43830","api":"https://cve.report/api/cve/CVE-2021-43830.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-43830","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-43830"},"summary":{"title":"CVE-2021-43830","description":"OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the \"Edit budgets\" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2021-12-14 20:15:00","updated_at":"2021-12-20 16:47:00"},"problem_types":["CWE-89"],"metrics":[],"references":[{"url":"https://github.com/opf/openproject/pull/9983.patch","name":"https://github.com/opf/openproject/pull/9983.patch","refsource":"MISC","tags":[],"title":"","mime":"text/x-diff","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/opf/openproject/pull/9983","name":"https://github.com/opf/openproject/pull/9983","refsource":"MISC","tags":[],"title":"Use the correct Rails finder when looking for reassign_to_id by oliverguenther · Pull Request #9983 · opf/openproject · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96","name":"https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96","refsource":"CONFIRM","tags":[],"title":"SQL injection in OpenProject budgets reassignment · Advisory · opf/openproject · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/opf/openproject/releases/tag/v12.0.4","name":"https://github.com/opf/openproject/releases/tag/v12.0.4","refsource":"MISC","tags":[],"title":"Release OpenProject 12.0.4 · opf/openproject · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43830","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43830","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"43830","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openproject","cpe5":"openproject","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2021-43830","STATE":"PUBLIC","TITLE":"SQL injection in OpenProject"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"openproject","version":{"version_data":[{"version_value":">= 12.0.0, < 12.0.4"}]}}]},"vendor_name":"opf"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the \"Edit budgets\" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch"}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}]},"references":{"reference_data":[{"name":"https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96","refsource":"CONFIRM","url":"https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96"},{"name":"https://github.com/opf/openproject/pull/9983","refsource":"MISC","url":"https://github.com/opf/openproject/pull/9983"},{"name":"https://github.com/opf/openproject/pull/9983.patch","refsource":"MISC","url":"https://github.com/opf/openproject/pull/9983.patch"},{"name":"https://github.com/opf/openproject/releases/tag/v12.0.4","refsource":"MISC","url":"https://github.com/opf/openproject/releases/tag/v12.0.4"}]},"source":{"advisory":"GHSA-f565-3whr-6m96","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2021-12-14 20:15:00","lastModifiedDate":"2021-12-20 16:47:00","problem_types":["CWE-89"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0.0","versionEndExcluding":"12.0.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"43830","Ordinal":"221338","Title":"CVE-2021-43830","CVE":"CVE-2021-43830","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"43830","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}