CVE-2025-52560

Estado: AnalizadaAlta (8.8)—

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.52%
Percentil entre todas las CVEs puntuadas: 42
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution90 %
Impacto principalT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access85 %
Impacto secundarioT1556 Modify Authentication Processdefense impairment · persistence · credential access75 %

CVE-2025-52560: phishing con enlace malicioso (T1203, UI:R) que redirige a dominio ataquante; los tokens filtrados permiten takeover de cuentas incluyendo admin (T1078.001: valid accounts; T1556: account modification).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Password Policies Multi-factor Authentication User Account Management Restrict File and Directory Permissions Restrict Registry Permissions Privileged Process Integrity

Tecnologías afectadas (1)

Kanboard — Kanboard

CWE

CWE-640

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-52560",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-52560",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-24T15:02:34.318703Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "kanboard",
          "product": "kanboard",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.46"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-24T03:15:34.653",
  "references": [
    {
      "url": "https://github.com/kanboard/kanboard/commit/bca2bd7ab95e7990e358fd35a7daf51a9c16aa75",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-2ch5-gqjm-8p92",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46."
    },
    {
      "lang": "es",
      "value": "Kanboard es un software de gestión de proyectos basado en la metodología Kanban. Antes de la versión 1.2.46, Kanboard permitía el envío de correos electrónicos de restablecimiento de contraseña con URL derivadas del encabezado Host no validado cuando la configuración application_url no estaba configurada (comportamiento predeterminado). Esto permite a un atacante manipular un enlace malicioso de restablecimiento de contraseña que filtra el token a un dominio controlado por el atacante. Si una víctima (incluido un administrador) hace clic en el enlace envenenado, su cuenta puede ser interceptada. Esto afecta a todos los usuarios que inicien un restablecimiento de contraseña sin que la configuración application_url esté configurada. Este problema se ha corregido en la versión 1.2.46."
    }
  ],
  "lastModified": "2026-06-17T09:36:40.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6D20FE2-A681-49ED-B6E6-1218CDDD6759",
              "versionEndExcluding": "1.2.46"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}