CVE-2023-0164 - OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server

Back Back to CVE browser

HIGH

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server

Published Jan 18, 2023

8.8

HIGH

CVSS 3.1

EPSS 1.38%

Description

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

Affected products

Vendor n/a Product OrangeScrum Default
n/a
- Version
  2.0.11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

OrangeScrum

n/a

Version	Status	Constraints
2.0.11	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://fluidattacks.com/advisories/queen/
ExploitThird Party Advisory
https://github.com/Orangescrum/orangescrum
ProductThird Party Advisory

Link	Providers	Tags
https://fluidattacks.com/advisories/queen/		ExploitThird Party Advisory
https://github.com/Orangescrum/orangescrum		ProductThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Fluid Attacks

Published Jan 18, 2023

Updated Apr 3, 2025

Reserved Jan 10, 2023

Link CVE-2023-0164

CISA Vulnrichment

Updated Apr 2, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-0164

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-0164