CVE-2023-0454
PoC —CVSS 3.1
8.1 high
EPSS
<1%p61
Published
()
Modified
Description
OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.
- Vendors
- orangescrum
- Products
- orangescrum
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.