VulnerabilityAnalyzed

CVE-2024-48392

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS).

MEDIUM 5.4EPSS 0.81%

Does this matter?

Lower severity and a low EPSS score (0.81%). Track it; it rarely justifies an emergency change on its own.

Description

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.81% probability · 55th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: orangescrum/orangescrum
Source: cve@mitre.org

References

https://github.com/Renzusclarke/CVE-2024-48392-PoCExploit
https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txtExploit
https://www.orangescrum.com/Product
https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txtExploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.