What’s Vulnerable › Vulnerabilities

CVE-2019-11600

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 80.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-13 · updated 2026-06-17
• Weakness: CWE-89

Description

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

Affected products

• opf openproject: from 5.0.0 before 8.3.2 — fixed in 8.3.2

How to fix

Upgrade to a fixed version: opf openproject 8.3.2. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.html
• http://seclists.org/fulldisclosure/2019/May/7
• https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
• https://seclists.org/bugtraq/2019/May/22
• https://www.openproject.org/release-notes/openproject-8-3-2/
• http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.html
• http://seclists.org/fulldisclosure/2019/May/7
• https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
• https://seclists.org/bugtraq/2019/May/22
• https://www.openproject.org/release-notes/openproject-8-3-2/

Get alerted when CVE-2019-11600 or the next vulnerability affects your stack