CVE-2023-0164

8.8 highEPSS 1.4%

High (8.8) in orangescrum orangescrum. EPSS 1.4% chance of exploitation in the next 30 days.

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2023-01-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

orangescrum:orangescrum

References

https://fluidattacks.com/advisories/queen/
https://github.com/Orangescrum/orangescrum
https://fluidattacks.com/advisories/queen/
https://github.com/Orangescrum/orangescrum

Check your stack JSON