| Package | Affected versions | Patched versions |
|---|---|---|
| yetiforce/yetiforce-crm | ≤ 6.3.0 | |
| yetiforce customer relationship management | < 6.3.0 | 6.3.0 |
Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free