CVE-2023-0738

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 40th percentile

Published

2023-04-04

Updated

2025-02-13

Proof-of-concept exploits (1)

• https://fluidattacks.com/advisories/eilish/

References

• CVE Record
• NVD entry

Related

• CVE-2023-0736
• CVE-2023-0739
• CVE-2023-0734
• CVE-2023-0740
• CVE-2023-0733
• CVE-2023-0741