5

CVE-2013-7222

Exploit
config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fatfreecrm ≫ Fat Free Crm Version <= 0.12.0
Fatfreecrm ≫ Fat Free Crm Version0.9.6
Fatfreecrm ≫ Fat Free Crm Version0.9.7
Fatfreecrm ≫ Fat Free Crm Version0.9.8
Fatfreecrm ≫ Fat Free Crm Version0.9.9
Fatfreecrm ≫ Fat Free Crm Version0.9.10
Fatfreecrm ≫ Fat Free Crm Version0.10.1
Fatfreecrm ≫ Fat Free Crm Version0.11.0
Fatfreecrm ≫ Fat Free Crm Version0.11.1
Fatfreecrm ≫ Fat Free Crm Version0.11.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.42% 0.821
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://openwall.com/lists/oss-security/2013/12/28/2
http://seclists.org/fulldisclosure/2013/Dec/199
http://www.phenoelit.org/stuff/ffcrm.txt
Exploit
https://github.com/fatfreecrm/fat_free_crm/commit/93c182dd4c6f3620b721d2a15ba6a6ecab5669df
Patch
Exploit
https://github.com/fatfreecrm/fat_free_crm/issues/300
https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29
Vendor Advisory