Medium severity · published Oct 9, 2019
CVE-2019-17092
An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter…
6.1
CVSS
1.7%
EPSS
No
On KEV
Description
An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openproject · Openproject
before 9.0.4; 10.0.0 before 10.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17092
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17092
packetstormsecurity.com
http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html
seclists.org
http://seclists.org/fulldisclosure/2019/Oct/29
groups.google.com
https://groups.google.com/forum/#%21topic/openproject-security/tEsx0UXWxXA
seclists.org
https://seclists.org/bugtraq/2019/Oct/19
Release Notes
https://www.openproject.org/release-notes/openproject-10-0-2/
Release Notes
https://www.openproject.org/release-notes/openproject-9-0-4/
More from Openproject
9.9
CVE-2026-25763
OpenProject is an open-source, web-based project management software
9.1
CVE-2026-22600
OpenProject is an open-source, web-based project management software
9.0
CVE-2026-24772
OpenProject is an open-source, web-based project management software
8.8
CVE-2026-24685
OpenProject is an open-source, web-based project management software
8.8
CVE-2021-43830
OpenProject is a web-based project management software