Vulnerability · Published Jan 18, 2023 · Assigned by Fluid Attacks
CVE-2023-0164
High 8.8
In plain English
A high-severity OS command injection in OrangeScrum. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.4%top 27.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | OrangeScrum | 2.0.11 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H