YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module

MEDIUM 5.4CVE-2022-3005 · GHSA-vx3x-hwph-grvw · Published 20/09/2022 · updated 17/06/2026

In short

CVE-2022-3005 is a MEDIUM (CVSS 5.4) vulnerability affecting yetiforce/yetiforce-crm, yetiforce customer relationship management (yetiforce).
Chance of exploitation in the next 30 days (EPSS): 0.65%, higher than 51.2% of all vulnerabilities.
Fix: update to 6.4.0 or later.

Package	Affected versions	Patched versions
yetiforce/yetiforce-crm Packagist	`≤ 6.4.0`	No fix yet
yetiforce customer relationship management yetiforce	`< 6.4.0`	`6.4.0`

Description

YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the SlaPolicy module. A patch is available at commit e55886781509fe39951fc7528347696474a17884.

NVD description

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-3005 · ADVISORY
yetiforcecompany/yetiforcecrm commit e558867 · WEB
YetiForceCompany/YetiForceCRM · PACKAGE
huntr.dev/bounties/4b144433-a979-4c4e-a627-659838acc217 · WEB

More vulnerabilities in yetiforce/yetiforce-crm

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

yetiforce/yetiforce-crm

Packagist

≤ 6.4.0

No fix yet

yetiforce customer relationship management

yetiforce

< 6.4.0

6.4.0

More vulnerabilities in yetiforce/yetiforce-crm

See all →