QwikSec

Security Database

CVE

CWE

Training

CVE-2025-24892

Published: Feb 10, 2025

Modified: Feb 12, 2025

PUBLISHED

CVSS v3.1

3.5

LOW

Description

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.

Vendor	Product	Versions
opf	openproject	affected `< 15.2.1`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

References

https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j

x_refsource_CONFIRM

https://github.com/opf/openproject/pull/17783

x_refsource_MISC

https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch

x_refsource_MISC

https://www.openproject.org/docs/release-notes/12-5-1

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.