CVE-2023-1783

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Orangescrum	Orangescrum	2.0.11

References

https://fluidattacks.com/advisories/stirling/Exploit, Third Party Advisory
https://github.com/Orangescrum/orangescrum/Product
https://fluidattacks.com/advisories/stirling/Exploit, Third Party Advisory
https://github.com/Orangescrum/orangescrum/Product

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-17849.8A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Do CVE-2023-17859.8A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as critical. Affected is an unknown CVE-2023-17865.5Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords CVE-2023-17875.3An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1 CVE-2023-17889.8Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.CVE-2023-17899.8Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.CVE-2023-17907.5A vulnerability, which was classified as problematic, was found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown CVE-2023-17919.8A vulnerability has been found in SourceCodester Simple Task Allocation System 1.0 and classified as critical. Affected by this vulnerabilit CVE-2023-17929.8A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0 and classified as critical. Affected by this issue is some CVE-2023-17939.8A vulnerability was found in SourceCodester Police Crime Record Management System 1.0. It has been classified as critical. This affects an u CVE-2023-17946.1A vulnerability was found in SourceCodester Police Crime Record Management System 1.0. It has been declared as problematic. This vulnerabili CVE-2023-17956.1A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been rated as problematic. This issue affects so