CVE-2023-0624

2023-02-0900:00:00

Fluid Attacks

www.cve.org

orangescrum

user accounts

external attacker

arbitrary

content-type

text/html

cve-2023-0624

EPSS

0.001

Percentile

37.4%

JSON

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "OrangeScrum",
    "versions": [
      {
        "version": "2.0.11",
        "status": "affected"
      }
    ]
  }
]

References

fluidattacks.com/advisories/oberhofer/

github.com/Orangescrum/orangescrum/

EPSS

0.001

Percentile

37.4%

JSON

Related for CVELIST:CVE-2023-0624