CVE-2021-39198GHSA-VF7H-6246-HM43
The disqualify lead action may be executed without CSRF token check
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.2.7, 4.1.17
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.
Timeline
- CVE published
- Record last updated
Affected versions
- oroinc crm
From 4.2.0 · fixed in 4.2.7; fixed in 4.1.17
- oro/crmPackagist
From 3.1.0 · fixed in 4.1.17
- oro/crmPackagist
From 4.2.0 · fixed in 4.2.7