Fat Free CRM Cross-Site Request Forgery vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-1585 · ADVISORY
• fatfreecrm/fat_free_crm commit 86fd7f9 · WEB
• exchange.xforce.ibmcloud.com/vulnerabilities/100925 · WEB
• fatfreecrm/fat_free_crm · PACKAGE
• fatfreecrm/fat_free_crm · WEB
• rubysec/ruby-advisory-db · WEB
• packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html · WEB
• securityfocus.com/archive/1/534709/100/0/threaded

fat_free_crm のその他の脆弱性

• GHSA-9pm8-vwc5-w2hm低Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID
• CVE-2022-39281中 6.5fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticate…
• CVE-2018-20975中 6.1Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
• CVE-2019-10226中 5.4HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOT…
• CVE-2018-1000842中 6.1FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnera…