OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.
References
Link | Resource |
---|---|
https://fluidattacks.com/advisories/queen/ | Exploit Third Party Advisory |
https://github.com/Orangescrum/orangescrum | Product Third Party Advisory |
Configurations
History
No history.
Information
Published : 2023-01-18 22:15
Updated : 2024-02-28 19:51
NVD link : CVE-2023-0164
Mitre link : CVE-2023-0164
CVE.ORG link : CVE-2023-0164
JSON object : View
Products Affected
orangescrum
- orangescrum
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')