HIGH8.0

GHSA-7g7r-gr46-q4p5

Cross-Site Request Forgery in yetiforce

Details

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/yetiforce/yetiforce-crm

Introduced in: 0

No fixed version published yet for yetiforce/yetiforce-crm (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0269[ADVISORY]
https://github.com/yetiforcecompany/yetiforcecrm/commit/298c7870e6fe4332d8aa1757a9c8d79f841389ff[WEB]
https://github.com/yetiforcecompany/yetiforcecrm[WEB]
https://huntr.dev/bounties/a0470915-f6df-45b8-b3a2-01aebe764df0[WEB]