Login Request a demo
High severity · published Jun 1, 2023
CVE-2023-33960
OpenProject vulnerable to project identifier information leakage through robots.txt
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available. Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openproject · opf
< 12.5.6 · source: vendor, NVD
Affected product
OP
openproject
opf
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33960
Permissions Required
https://community.openproject.org/wp/48324
Patch
https://github.com/opf/openproject/pull/12708
Release Notes
https://github.com/opf/openproject/releases/tag/v12.5.6
Vendor Advisory
https://github.com/opf/openproject/security/advisories/GHSA-xjfc-fqm3-95q8
Mailing List
https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/12708.patch
More from openproject
9.9
CVE-2026-46386
OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
9.9
CVE-2026-52782
OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
9.9
CVE-2026-52785
OpenProject: SQL injection in timestamps functionality
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.6
CVE-2026-52780
OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)