CVE-2023-0624

6.1 mediumEPSS 0.5%

Medium (6.1) in orangescrum orangescrum. EPSS 0.5% chance of exploitation in the next 30 days.

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-02-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

orangescrum:orangescrum

References

https://fluidattacks.com/advisories/oberhofer/
https://github.com/Orangescrum/orangescrum/
https://fluidattacks.com/advisories/oberhofer/
https://github.com/Orangescrum/orangescrum/

Check your stack JSON