OrangeScrum vulnerabilities
We track 3 vulnerabilities in OrangeScrum products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2023.
Latest OrangeScrum vulnerabilities
- 7.6 High severity
Orangescrum: Improper Neutralization of Input During Web Page Generation
OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.
- 8.1 High severity
OrangeScrum: Improper Limitation of a Pathname to a Restricted Directory
OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.
- 8.8 High severity
OrangeScrum: Improper Neutralization of Special Elements used in an OS Command
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.