GCVE - cpe:2.3:a:openproject:openproject:14.1.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openproject:openproject:14.1.0:*:*:*:*:*:*:*

part: a version: 14.1.0 update: *

Vendor	Openproject (`2141e1b6-6476-5da4-b6d1-3bcb9f680d15`)
Product	Openproject (`9ad6b548-e1c9-5e3e-becf-b8b471ee1220`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/opf/openproject`	purl2cpe	2026-06-01 10:12:40.437568
`pkg:rpm/opensuse/openproject`	purl2cpe	2026-06-01 10:12:40.437570
`pkg:sourceforge/openproject.mirror`	purl2cpe	2026-06-01 10:12:40.437571

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-35224`	vulnerable	2026-06-08 06:37:35.473909	Stored Cross-Site Scripting (XSS) in OpenProject HIGH (7.6) OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2. Published: 2024-05-23T12:53:04.336Z Updated: 2024-08-02T03:07:46.774Z Open on db.gcve.eu Reference links https://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc https://community.openproject.org/projects/openproject/work_packages/55198/relations	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.