OrangeScrum Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in OrangeScrum version 2.0.11. This issue allows attackers to inject malicious JavaScript into user email fields, exploiting inadequate input validation. The consequence of this vulnerability could be account takeover.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into an affected OrangeScrum account and navigate to the user profile or settings where email information can be edited. Inject a script into the email field, taking advantage of the lack of input validation. Save the changes, and the injected script will execute, demonstrating the XSS vulnerability.