CVE-2025-24892

MEDIUM EPSS 18.9%
Published Feb 10, 20251y ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Feb 10, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
18.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
openprojectopenproject* <15.2.1

References 4

  • github.com https://github.com/opf/openproject/pull/17783
    Patch
  • github.com https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j
    PatchVendor Advisory
  • patch-diff.githubusercontent.com https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch
    Patch
  • openproject.org https://www.openproject.org/docs/release-notes/12-5-1
    Release Notes

Remediation

  • github.com https://github.com/opf/openproject/pull/17783
    Patch
  • github.com https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j
    PatchVendor Advisory
  • patch-diff.githubusercontent.com https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch
    Patch