OpenProject Stored Cross-Site Scripting Vulnerability in Group Management

A stored cross-site scripting vulnerability has been identified in OpenProject, an open-source web-based project management software, in versions prior to 15.2.1. The issue arises in the Group Management section, where user input is not properly sanitized before being displayed. Groups created with HTML script tags can execute scripts when rendered in a project.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the Group Management section.

Remediation

Users can upgrade to OpenProject version 15.2.1, where this issue has been fixed. For those unable to upgrade, a manual patch is available.