CVE-2023-0738

2023-04-0400:00:00

Fluid Attacks

www.cve.org

orangescrum

version 2.0.11

security vulnerability

external attacker

arbitrary user accounts

malicious user input

response

content-type

text/html

EPSS

0.001

Percentile

42.8%

JSON

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "OrangeScrum",
    "versions": [
      {
        "version": "2.0.11",
        "status": "affected"
      }
    ]
  }
]

References

fluidattacks.com/advisories/eilish/

github.com/Orangescrum/orangescrum/

EPSS

0.001

Percentile

42.8%

JSON

Related for CVELIST:CVE-2023-0738