CVE-2019-11600

HIGH 8.1CVE-2019-11600 · Published 13/05/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
openproject openproject	`≥ 5.0.0, < 8.3.2`	`8.3.2`

Description

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

References

packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.html · Exploit
seclists.org/fulldisclosure/2019/May/7 · Exploit
groups.google.com/forum
seclists.org/bugtraq/2019/May/22 · Exploit
openproject.org/release-notes/openproject-8-3-2 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free