Description

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.

INFO

Published Date :

2025-02-10T15:46:29.540Z

Last Modified :

2025-02-12T15:45:38.543Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-24892 vulnerability.

Vendors Products
Openproject
  • Openproject
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-24892.

URL Resource
https://github.com/opf/openproject/pull/17783 cve-icon cve-icon
https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j cve-icon cve-icon
https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch cve-icon cve-icon
https://www.openproject.org/docs/release-notes/12-5-1 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact