Remote Command Execution Vulnerability in OrangeScrum by FluidAttacks

CVE-2023-0164

What is CVE-2023-0164?

The vulnerability in OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This situation arises due to the application improperly sanitizing user inputs, resulting in the injection of attacker-controlled parameters into system functions. Consequently, this flaw poses a risk of unauthorized access and manipulation of the server's operations, making it essential for users to apply updates or mitigate the risk.

References