CVE-2023-0164

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.
References
Link Resource
https://github.com/Orangescrum/orangescrum Product Third Party Advisory
https://fluidattacks.com/advisories/queen/ Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:orangescrum:orangescrum:2.0.11:*:*:*:*:*:*:*

Information

Published : 2023-01-18 10:15

Updated : 2023-01-28 03:37


NVD link : CVE-2023-0164

Mitre link : CVE-2023-0164

Products Affected
CWE