Medium severity · published Jan 21, 2025
CVE-2024-48392
OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS)
5.4
CVSS
0.8%
EPSS
No
On KEV
Description
OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
Orangescrum · Orangescrum
2.0.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-48392
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-48392
Exploit
https://github.com/Renzusclarke/CVE-2024-48392-PoC
Exploit
https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt
Product
https://www.orangescrum.com/
More from Orangescrum
8.8
CVE-2021-47721
Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation
8.8
CVE-2023-0164
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server
8.1
CVE-2023-0454
OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server
7.6
CVE-2023-1783
OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering
7.1
CVE-2021-47720
Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters