VULNERABILITY INTELLIGENCE

CVE-2023-1783

CVSS score6.5 MEDIUM
EPSS probability0.58%
CISA KEVNot currently listed
Published2023-06-23
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.

Weakness classification

  • help@fluidattacks.com: CWE-79
  • nvd@nist.gov: CWE-79

Primary references