CVE-2025-24892: openproject

csirt@kutim:~/threat-intel/cve/CVE-2025-24892

CVSS 5.4 · Medium EPSS 0,30%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada openproject. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.

Rincian

Terbit di NVD: 10 Februari 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 20,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openproject	openproject	Semua versi sebelum 15.2.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j patch · advisory vendor
https://github.com/opf/openproject/pull/17783 patch
https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch patch
https://www.openproject.org/docs/release-notes/12-5-1 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.