CVE-2024-55603

{
  "id": "CVE-2024-55603",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-55603",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-20T20:10:11.562584Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "kanboard",
          "product": "kanboard",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.43"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-19T00:15:06.713",
  "references": [
    {
      "url": "https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/kanboard/kanboard/commit/7ce61c34d962ca8b5dce776289ddf4b207be6e78",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-gv5c-8pxr-p484",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.php.net/manual/en/function.session-start.php",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.php.net/manual/en/session.configuration.php#ini.session.gc-divisor",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probability",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.php.net/manual/en/sessionhandlerinterface.gc.php",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if a given `session_id` has already exceeded its lifetime (`expires_at`).\nThus, a session which's lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented **SessionHandlerInterface::gc** function, that does remove invalid sessions, is called only **with a certain probability** (_Cleans up expired sessions. Called by `session_start()`, based on `session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gc_probability=1, session.gc_divisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "Kanboard es un software de gestión de proyectos que se centra en la metodología Kanban. En las versiones afectadas, las sesiones aún se pueden utilizar aunque su vida útil haya excedido. Kanboard implementa un gestionador de sesión personalizado (`app/Core/Session/SessionHandler.php`), para almacenar los datos de la sesión en una base de datos. Por lo tanto, cuando se proporciona un `session_id`, Kanboard consulta los datos de la tabla SQL `sessions`. En este punto, no verifica correctamente si un `session_id` dado ya ha excedido su vida útil (`expires_at`). Por lo tanto, una sesión cuya vida útil ya es `&gt; time()`, aún se consulta desde la base de datos y, por lo tanto, es un inicio de sesión válido. La función **SessionHandlerInterface::gc** implementada, que elimina sesiones no válidas, se llama solo **con cierta probabilidad** (_Limpia sesiones caducadas. Llamada por `session_start()`, basada en las configuraciones `session.gc_divisor`, `session.gc_probability` y `session.gc_maxlifetime`_) de acuerdo con la documentación de php. En la imagen oficial de Docker de Kanboard, estos valores predeterminados son: session.gc_probability=1, session.gc_divisor=1000. Por lo tanto, una sesión caducada solo se termina con una probabilidad de 1/1000. Este problema se ha solucionado en la versión 1.2.43 y se recomienda a todos los usuarios que actualicen. No existen workarounds conocidos para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T08:11:18.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79E29EC0-1572-49D5-8077-7803D7AD75C3",
              "versionEndExcluding": "1.2.43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}