CVE-2023-0164

2023-01-1800:00:00

Fluid Attacks

www.cve.org

orangescrum

version 2.0.11

command execution

server vulnerability

system function

AI Score

9.1

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "OrangeScrum",
    "versions": [
      {
        "version": "2.0.11",
        "status": "affected"
      }
    ]
  }
]

References

fluidattacks.com/advisories/queen/

github.com/Orangescrum/orangescrum