OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/stirling/ | Exploit Third Party Advisory |
| https://github.com/Orangescrum/orangescrum/ | Product |
| https://fluidattacks.com/advisories/stirling/ | Exploit Third Party Advisory |
| https://github.com/Orangescrum/orangescrum/ | Product |
Configurations
History
21 Nov 2024, 07:39
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://fluidattacks.com/advisories/stirling/ - Exploit, Third Party Advisory | |
| References | () https://github.com/Orangescrum/orangescrum/ - Product |
06 Jul 2023, 17:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:orangescrum:orangescrum:2.0.11:*:*:*:*:*:*:* | |
| CWE | CWE-79 | |
| First Time |
Orangescrum
Orangescrum orangescrum |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.6 |
| References | (MISC) https://github.com/Orangescrum/orangescrum/ - Product | |
| References | (MISC) https://fluidattacks.com/advisories/stirling/ - Exploit, Third Party Advisory |
23 Jun 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-23 22:15
Updated : 2024-11-21 07:39
NVD link : CVE-2023-1783
Mitre link : CVE-2023-1783
CVE.ORG link : CVE-2023-1783
JSON object : View
Products Affected
orangescrum
- orangescrum
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')