CVE-2025-24892 - CVE House
Back to Database
Status published Low CVE-2025-24892

OpenProject stored HTML injection vulnerability

Vulnerability Description

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24892

Credits & Attribution

No credits recorded in the NVD database.

References

More from opf

View All →
CVE-2024-41801
OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration
Medium 4.7
CVE-2024-35224
Stored Cross-Site Scripting (XSS) in OpenProject
High 7.6
CVE-2023-33960
OpenProject vulnerable to project identifier information leakage through robots.txt
High 7.5
CVE-2023-31140
OpenProject user sessions not terminated after activation of 2FA
Medium 4.8
CVE-2021-43830
SQL injection in OpenProject
High 7.4

Affected Vendor

Affected Software

openproject
Vulnerable Versions:
< 15.2.1

Timeline

Official Publish: February 10th, 2025
Last Modified: February 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact