6.1
Moyenne
CVE-2023-0624 OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application
Description
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OrangeScrum | 2.0.11 | Pas de correctif indiqué |
Autres CVE de OrangeScrum
Les 4 CVE de OrangeScrum →
CVE-2023-0738
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application
6.1
Moyenne
CVE-2023-0454
OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server
8.1
Élevée
CVE-2023-0164
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server
8.8
Élevée