Medium severity · published May 22, 2023
CVE-2023-31779
Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS)
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Wekan · Wekan Project
through 6.84 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-31779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-31779
Release Notes
https://github.com/wekan/wekan/blob/master/CHANGELOG.md
Patch
https://github.com/wekan/wekan/commit/47ac33d6c234359c31d9b5eae49ed3e793907279
More from Wekan
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.8
CVE-2026-1963
WeKan Attachment Storage attachments.js MoveStorageBleed access control
9.8
CVE-2026-1962
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
8.8
CVE-2026-2206
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
8.8
CVE-2026-25859
WeKan < 8.20 Migration Functionality Insufficient Permission Checks