High severity · published Dec 14, 2021
CVE-2021-43830
OpenProject is a web-based project management software
8.8
CVSS
1%
EPSS
No
On KEV
Description
OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openproject · Openproject
12.0.0 before 12.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43830
Patch
https://github.com/opf/openproject/pull/9983
Patch
https://github.com/opf/openproject/pull/9983.patch
Release Notes
https://github.com/opf/openproject/releases/tag/v12.0.4
Third Party Advisory
https://github.com/opf/openproject/security/advisories/GHSA-f565-3whr-6m96
More from Openproject
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.1
CVE-2026-22600
OpenProject is an open-source, web-based project management software
9.0
CVE-2026-24772
OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
8.8
CVE-2026-24685
OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
8.1
CVE-2026-34717
OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string