CVE-2023-33969: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-06-05T20:15Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Template/board/tooltip_external_links.php, app/Template/task_external_link/table.php
Commit date: 2023-06-02 20:31:41 -0700
Commit message: Avoid stored XSS in task external link

Diff: diff --git a/app/Template/board/tooltip_external_links.php b/app/Template/board/tooltip_external_links.php
index 2c287adf24..fd5237ae3f 100644
--- a/app/Template/board/tooltip_external_links.php
+++ b/app/Template/board/tooltip_external_links.php
@@ -9,11 +9,11 @@
             <tr>
                 <td>
                     <?= $link['type'] ?>
                 </td>
                 <td>
-                    <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
+                    <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
                 </td>
                 <td>
                     <?= $this->text->e($link['dependency_label']) ?>
                 </td>
             </tr>
diff --git a/app/Template/task_external_link/table.php b/app/Template/task_external_link/table.php
index 315fada6d9..816f5335ee 100644
--- a/app/Template/task_external_link/table.php
+++ b/app/Template/task_external_link/table.php
@@ -27,11 +27,11 @@
                 </div>
                 <?php endif ?>
                 <?= $this->text->e($link['type']) ?>
             </td>
             <td>
-                <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>
+                <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>
             </td>
             <td>
                 <?= $this->text->e($link['dependency_label']) ?>
             </td>
             <td>

Vulnerable code:                     <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
                <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>
Fixed code:                     <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
                <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>