CVE-2025-24892CWE-79

OpenProject stored HTML injection vulnerability

Low · published February 10, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-02-10T15:46Z
EPSS history
Timeline
  • 10 FEB 15:46Z
    OpenProject stored HTML injection vulnerability
    cvelistv5