CVE-2019-17092

Published: Oct 9, 2019Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.

Affected (2)

Products: Openproject: Openproject

Openproject

1 product

Openproject

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openproject Openproject	Before 9.0.4
Openproject Openproject	From 10.0.0 to 10.0.2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (12)

http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2019/Oct/29

Source: cve@mitre.org

https://groups.google.com/forum/#%21topic/openproject-security/tEsx0UXWxXA

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Oct/19

Source: cve@mitre.org

https://www.openproject.org/release-notes/openproject-10-0-2/

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.openproject.org/release-notes/openproject-9-0-4/

Source: cve@mitre.org

Release NotesVendor Advisory

http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html