MEDIUM6.1

GHSA-v8hp-239v-9367

OroCRM Forced Redirect to External Website

Quick fix

GHSA-v8hp-239v-9367 — oro/crm: upgrade to the fixed version with the command below.

composer require oro/crm:^1.7.4

Details

OroCRM is prone to open redirection which could allow attackers to redirect users to external website.

Enter the version of the package you're using.

Introduced in: 1.7.0Fixed in: 1.7.4

Fixcomposer require oro/crm:^1.7.4