Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2023-0454

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized a

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Fluid Attacks

Description

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a OrangeScrum

  • 2.0.11affected

References