CVE-2023-31140 json
OpenProject user sessions not terminated after activation of 2FA
published 2023-05-08 3 y ago modified 2026-06-17 4 mo ago also BIT-openproject-2023-31140 , EUVD-2023-35460 , GHSA-xfp9-qqfj-x28q
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device. As a workaround, users who register the first 2FA device on their account can manually log out to terminate all other active sessions. This is the default behavior of OpenProject but might be disabled through a configuration option. Double check that this option is not overridden if one plans to employ the workaround.
Patch / fix
- bitnami openproject 12.5.4
- openproject openproject 12.5.4
- github.com/opf/openproject#12508 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- community.openproject.org https://community.openproject.org/wp/48035 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | openproject | >=7.4.0, <12.5.4 |
12.5.4 |
Affected products
- opf openproject
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/opf/openproject/pull/12508
patch, web
-
community.openproject.org
/wp/48035
exploit, web
-
github.com
/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28q
mitigation, vendor-advisory, web
-
openproject.org
/docs/release-notes/12-5-4/
mitigation, release-notes, web
Sources
- CVE List CVE-2023-31140
- NVD CVE-2023-31140
- OSV BIT-openproject-2023-31140
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.