Sherpa Orchestrator
4 CVEs affecting Sherpa Orchestrator. Latest disclosed: 2025-04-25. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46544 | Medium | 6.4 | 2025-04-25 | In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. |
CVE-2025-46547 | Medium | 5.4 | 2025-04-25 | In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding… |
CVE-2025-46545 | Medium | 4.4 | 2025-04-25 | In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter… |
CVE-2025-46546 | Low | 3.5 | 2025-04-25 | In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/fi… |