CVE-2019-17092 - An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled

Back Back to CVE browser

MEDIUM

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled

Published Oct 9, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 1.66%

Description

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html
x_refsource_MISC
http://seclists.org/fulldisclosure/2019/Oct/29
mailing-listx_refsource_FULLDISC
https://groups.google.com/forum/#%21topic/openproject-security/tEsx0UXWxXA
x_refsource_MISC
https://seclists.org/bugtraq/2019/Oct/19
mailing-listx_refsource_BUGTRAQ
https://www.openproject.org/release-notes/openproject-10-0-2/
x_refsource_CONFIRMRelease NotesVendor Advisory
https://www.openproject.org/release-notes/openproject-9-0-4/
x_refsource_CONFIRMRelease NotesVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html		x_refsource_MISC
http://seclists.org/fulldisclosure/2019/Oct/29		mailing-listx_refsource_FULLDISC
https://groups.google.com/forum/#%21topic/openproject-security/tEsx0UXWxXA		x_refsource_MISC
https://seclists.org/bugtraq/2019/Oct/19		mailing-listx_refsource_BUGTRAQ
https://www.openproject.org/release-notes/openproject-10-0-2/		x_refsource_CONFIRMRelease NotesVendor Advisory
https://www.openproject.org/release-notes/openproject-9-0-4/		x_refsource_CONFIRMRelease NotesVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 9, 2019

Updated Aug 5, 2024

Reserved Oct 2, 2019

Link CVE-2019-17092

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-17092

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-17092