CVE-2024-48392

{"id": "CVE-2024-48392", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2025-01-21T21:15:10.837", "references": [{"url": "https://github.com/Renzusclarke/CVE-2024-48392-PoC", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.orangescrum.com/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover."}, {"lang": "es", "value": "OrangeScrum v2.0.11 es vulnerable a Cross Site Scripting (XSS). Un atacante puede inyectar c\u00f3digo JavaScript malicioso en el correo electr\u00f3nico del usuario debido a la falta de validaci\u00f3n de entrada, lo que podr\u00eda provocar el robo de la cuenta."}], "lastModified": "2025-09-30T21:01:01.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:orangescrum:orangescrum:2.0.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "563467F2-799D-404D-89D2-A6B5B6092614"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}