CVE-2019-17092

CVE Database · CVE-2019-17092

CVE-2019-17092

· MEDIUMModified

CVSS v3.1

6.1

EPSS

1.66%

Published

Oct 9, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (2)

openproject · openproject (up to 9.0.4)vulnerable

openproject · openproject (up to 10.0.2)vulnerable

References (12)

http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html

http://seclists.org/fulldisclosure/2019/Oct/29

https://groups.google.com/forum/#%21topic/openproject-security/tEsx0UXWxXA

https://seclists.org/bugtraq/2019/Oct/19

https://www.openproject.org/release-notes/openproject-10-0-2/

Release NotesVendor Advisory

https://www.openproject.org/release-notes/openproject-9-0-4/

Release NotesVendor Advisory

http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html

http://seclists.org/fulldisclosure/2019/Oct/29

KEV Catalog EPSS Scores Vendors All CVEs