PT-2023-16050 · Unknown · Orangescrum

Carlos Bello · CVE-2023-0164 · Publicado 2023-01-18 · Atualizado 2023-01-28

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OrangeScrum version 2.0.11

Description The issue allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

Recommendations For OrangeScrum version 2.0.11, as a temporary workaround, consider restricting access to system functions that inject user-controlled parameters until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-0164

Produtos afetados

Orangescrum

Referências · 5

• 🔥 https://fluidattacks.com/advisories/queen · Exploit
• https://github.com/Orangescrum/orangescrum · Nota
• https://t.me/cvenotify/43005 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0164 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0164 · Aviso do Fabricante