Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-33960 Details

Description

OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available. Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://community.openproject.org/wp/48324	CVE	Permissions Required
https://github.com/opf/openproject/pull/12708	CVE	Patch
https://github.com/opf/openproject/releases/tag/v12.5.6	CVE	Release Notes
https://github.com/opf/openproject/security/advisories/GHSA-xjfc-fqm3-95q8	CVE	Vendor Advisory
https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/12708.patch	CVE	Mailing ListPatch
https://community.openproject.org/wp/48324	[email protected]	Permissions Required
https://github.com/opf/openproject/pull/12708	[email protected]	Patch
https://github.com/opf/openproject/releases/tag/v12.5.6	[email protected]	Release Notes
https://github.com/opf/openproject/security/advisories/GHSA-xjfc-fqm3-95q8	[email protected]	Vendor Advisory
https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/12708.patch	[email protected]	Mailing ListPatch

see all 10 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-319	Cleartext Transmission of Sensitive Information	[email protected]
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	[email protected]

Affected Products

Product	Versions
openproject openproject	< 12.5.6
CPE cpe:2.3:a:openproject:openproject:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jun 9, 2023	Initial Analysis	[email protected]