CVE-2019-17092

MEDIUM 6.1CVE-2019-17092 · Published 09/10/2019 · updated 17/06/2026

In short

CVE-2019-17092 is a MEDIUM (CVSS 6.1) vulnerability affecting openproject (openproject).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.6% of all vulnerabilities.
Fix: update to 10.0.2, 9.0.4 or later.

Package	Affected versions	Patched versions
openproject openproject	`≥ 10.0.0, < 10.0.2< 9.0.4`	`10.0.29.0.4`

Description

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.

References

packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html
seclists.org/fulldisclosure/2019/Oct/29
groups.google.com/forum
seclists.org/bugtraq/2019/Oct/19
openproject.org/release-notes/openproject-10-0-2 · Release Notes
openproject.org/release-notes/openproject-9-0-4 · Release Notes

More vulnerabilities in openproject

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openproject

≥ 10.0.0, < 10.0.2< 9.0.4

10.0.29.0.4

More vulnerabilities in openproject

See all →