CVE-2023-0164

2023-01-1822:15:10

Google

osv.dev

orangescrum

command execution

parameter injection

cve-2023-0164

software

server vulnerability

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

References

fluidattacks.com/advisories/queen/

github.com/Orangescrum/orangescrum