PT-2023-16491 · Unknown · Orangescrum

Carlos Bello · CVE-2023-0738 · Publicado 2023-04-04 · Atualizado 2023-04-17

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrangeScrum version 2.0.11

Description The issue allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

Recommendations For OrangeScrum version 2.0.11, update the application to prevent it from returning malicious user input in the response. As a temporary workaround, consider validating and sanitizing all user input to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-0738

Produtos afetados

Orangescrum

Referências · 4

• 🔥 https://fluidattacks.com/advisories/eilish · Exploit
• https://osv.dev/vulnerability/CVE-2023-0738 · Aviso do Fabricante
• https://github.com/Orangescrum/orangescrum · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-0738 · Nota de Segurança