OpenProject Meeting Agenda Item Transfer Vulnerability via Improper Drag-and-Drop Handling

A vulnerability in OpenProject prior to version 17.0.2 allows for the improper transfer of meeting agenda items between different meetings. The issue arises because the drag-and-drop functionality does not adequately verify whether the target section belongs to the same meeting or is part of the backlog for recurring meetings. As a result, an attacker could move agenda items into another meeting, potentially causing confusion, although they would not gain access to the meetings themselves.

Impact

Exploitation of this vulnerability could lead to cross-project transfer of meeting agenda items, causing confusion by misplacing agenda items in incorrect meetings.

Remediation

Users can update to OpenProject version 17.0.2, which addresses this vulnerability. If an immediate update is not possible, administrators can review and manage the 'Manage Agenda Items' permission for users.