CVE-2019-17092: XSS
Published Oct 9, 2019
·Updated
An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.
Affected Software
2 affected components
OpenProject OpenProject<9.0.4
OpenProject OpenProject>=10.0.0<10.0.2
Remediation
Event History
Oct 9, 2019
CVE Published
via MITRE·06:22 PM
Data Sourced
via MITRE·06:22 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-17092?
CVE-2019-17092 is considered a medium severity vulnerability due to its potential for exploitation via XSS attacks.
2
How do I fix CVE-2019-17092?
To fix CVE-2019-17092, upgrade OpenProject to version 9.0.4 or 10.0.2 or later.
3
What versions of OpenProject are affected by CVE-2019-17092?
CVE-2019-17092 affects OpenProject versions prior to 9.0.4 and 10.x versions before 10.0.2.
4
What type of vulnerability is CVE-2019-17092?
CVE-2019-17092 is an XSS (Cross-Site Scripting) vulnerability.
5
Can CVE-2019-17092 be exploited remotely?
Yes, CVE-2019-17092 can be exploited remotely by attackers through the mishandling of error messages.