{"id":"CVE-2017-11667","aliases":["EUVD-2017-3279","GHSA-2w7h-66vj-246p"],"status":"published","title":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote...","description":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0142,"percentile":0.73014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2017-07-26T20:00:00Z","modified":"2026-10-20T10:51:11Z","products":[{"vendor":"openproject","product":"openproject"}],"references":[{"url":"https://www.openproject.org/openproject-6-1-6-released-security-fix/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.openproject.org/openproject-7-0-3-released/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/opf/openproject/commit/0fdd7578909d2ec50abc275fc4962e99566437ee","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11667"},{"url":"https://www.openproject.org/openproject-6-1-6-released-security-fix"},{"url":"https://www.openproject.org/openproject-7-0-3-released"},{"url":"https://github.com/advisories/GHSA-2w7h-66vj-246p"}],"sources":{"cve":[{"id":"CVE-2017-11667","description":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.","status":"published","published":"2017-07-26T20:00:00Z","modified":"2024-09-16T18:18:09.703Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2017-3279","description":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.","status":"published","published":"2017-07-26T20:00:00Z","modified":"2024-09-16T18:18:09Z","updated_at":"2026-11-03T00:55:33.878386Z"}],"ghsa":[{"id":"GHSA-2w7h-66vj-246p","title":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote...","description":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.","status":"published","published":"2022-05-13T01:42:27Z","modified":"2025-04-20T03:42:33Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:01:49.538564Z"}],"nvd":[{"id":"CVE-2017-11667","description":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.","status":"published","published":"2017-07-26T20:29:00.223Z","modified":"2026-06-17T01:02:10.56Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:03:54.862898Z"}],"osv":[{"id":"CVE-2017-11667","description":"OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.","status":"published","published":"2017-07-26T20:29:00.223Z","modified":"2026-10-20T10:51:11.541393574Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"}]}}