8.1
High
CVE-2023-0454 OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server
Description
OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OrangeScrum | 2.0.11 | No fix stated |
Other CVEs of OrangeScrum
The 4 CVEs of OrangeScrum →
CVE-2023-0738
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application
6.1
Medium
CVE-2023-0624
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application
6.1
Medium
CVE-2023-0164
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server
8.8
High