MEDIUM5.4

GHSA-jr37-66pj-36v7

Cross-site Scripting in DayByDay CRM

Quick fix

GHSA-jr37-66pj-36v7 — bottelet/flarepoint: upgrade to the fixed version with the command below.

composer require bottelet/flarepoint:^2.2.1

Details

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/bottelet/flarepoint

Introduced in: 0Fixed in: 2.2.1

Fixcomposer require bottelet/flarepoint:^2.2.1

References

https://nvd.nist.gov/vuln/detail/CVE-2022-22109[ADVISORY]
https://github.com/Bottelet/DaybydayCRM/commit/002dc75f400cf307bd00b71a5a93f1e26e52cee2[WEB]
https://github.com/Bottelet/DaybydayCRM[PACKAGE]
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22109[WEB]