CVE-2023-1783 — OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering

CVE-2023-1783

OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering PUBLISHED

Description (CNA)

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.

Affected (CNA)

Vendor / product	Versions
Orangescrum / Orangescrum	affected 2.0.11

CWE

CWE-79

References

https://github.com/Orangescrum/orangescrum/
https://fluidattacks.com/advisories/stirling/

ADP enrichment

CVE

No English description supplied.

https://github.com/Orangescrum/orangescrum/
https://fluidattacks.com/advisories/stirling/

CISA-ADP

No English description supplied.

No references supplied.