Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

概要

参考情報

• fatfreecrm/fat_free_crm security advisory · WEB
• fatfreecrm/fat_free_crm · PACKAGE

fat_free_crm のその他の脆弱性

• CVE-2022-39281中 6.5fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticate…
• CVE-2018-20975中 6.1Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
• CVE-2019-10226中 5.4HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOT…
• CVE-2018-1000842中 6.1FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnera…
• CVE-2015-1585中 6.8Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authentici…