OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/stirling/ | Exploit Third Party Advisory |
| https://github.com/Orangescrum/orangescrum/ | Product |
| https://fluidattacks.com/advisories/stirling/ | Exploit Third Party Advisory |
| https://github.com/Orangescrum/orangescrum/ | Product |
Configurations
History
21 Nov 2024, 07:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://fluidattacks.com/advisories/stirling/ - Exploit, Third Party Advisory | |
| References | () https://github.com/Orangescrum/orangescrum/ - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
06 Jul 2023, 17:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:orangescrum:orangescrum:2.0.11:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/Orangescrum/orangescrum/ - Product | |
| References | (MISC) https://fluidattacks.com/advisories/stirling/ - Exploit, Third Party Advisory | |
| First Time |
Orangescrum orangescrum
Orangescrum |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.6 |
| CWE | CWE-79 |
23 Jun 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-23 22:15
Updated : 2024-11-21 07:39
NVD link : CVE-2023-1783
Mitre link : CVE-2023-1783
CVE.ORG link : CVE-2023-1783
JSON object : View
Products Affected
orangescrum
- orangescrum
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')