5.8

CVE-2021-39198

The disqualify lead action may be executed without CSRF token check

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oroinc ≫ Client Relationship Management Version >= 3.1.0 <= 3.1.24
Oroinc ≫ Client Relationship Management Version >= 4.1.0 <= 4.1.15
Oroinc ≫ Client Relationship Management Version >= 4.2.0 <= 4.2.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.217
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:N/I:P/A:P
security-advisories@github.com 4.2 1.6 2.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43
Third Party Advisory