Security Advisory

CVE-2023-0738

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-04-04 00:00:00

Last updated 2025-02-13 16:02:01

Assigner Fluid Attacks

State PUBLISHED

Description

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

← Browse all CVEs View on cve.org ↗