Lucene search

[email protected]CVE-2013-7224

HistoryJan 02, 2014 - 2:59 p.m.

CVE-2013-7224

2014-01-0214:59:00

CWE-200

[email protected]

web.nvd.nist.gov

fat free crm

cve-2013-7224

information security

json serialization

remote attackers

6.2 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

78.3%

JSON

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json.

CPENameOperatorVersion
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.11.0
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.10
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.8
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.7
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.10.1
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.11.1
fatfreecrm:fat_free_crmfatfreecrm fat free crmle0.12.0
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.6
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.11.2
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.9

CPE	Name	Operator	Version
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.11.0
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.10
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.8
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.7
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.10.1
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.11.1
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	le	0.12.0
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.6
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.11.2
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.9

References

openwall.com/lists/oss-security/2013/12/28/2

seclists.org/fulldisclosure/2013/Dec/199

www.phenoelit.org/stuff/ffcrm.txt

github.com/fatfreecrm/fat_free_crm/commit/cf26a04b356ad2161c4c6160260eb870a3de5328

github.com/fatfreecrm/fat_free_crm/issues/300

github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29

6.2 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

78.3%

JSON

Related for CVE-2013-7224

osv2 prion2 cvelist2 github2 cve1