Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2021-39198: Build software better, together

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

CVE
#csrf#vulnerability

The disqualify lead action may be executed without CSRF token check

Package

composer oro/crm (composer)

Affected versions

>=3.1.0, <=3.1.24 || >=4.1.0, <=4.1.15 || >=4.2.0, <=4.2.5

Patched versions

4.2.7, 4.1.17

Description

Summary

The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack.

Workarounds

There are no workarounds that address this vulnerability.

CVSS Score

4.2 Moderate

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907