Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

Description

References

• fatfreecrm/fat_free_crm security advisory · WEB
• fatfreecrm/fat_free_crm · PACKAGE

Altre vulnerabilità di fat_free_crm

• CVE-2022-39281MEDIO 6.5fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticate…
• CVE-2018-20975MEDIO 6.1Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
• CVE-2019-10226MEDIO 5.4HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOT…
• CVE-2018-1000842MEDIO 6.1FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnera…
• CVE-2015-1585MEDIO 6.8Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authentici…