YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-2924 · ADVISORY
• yetiforcecompany/yetiforcecrm commit b716ece · WEB
• YetiForceCompany/YetiForceCRM · PACKAGE
• huntr.dev/bounties/f0f3aded-6e97-4cf2-980a-c90f2c6ca0e0 · WEB

yetiforce/yetiforce-crm のその他の脆弱性

• CVE-2023-49508中 6.5Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtai…
• CVE-2022-3002中 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
• CVE-2022-3005中 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
• CVE-2022-3004中 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
• CVE-2022-3000中 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.