CVE-2013-7249

2014-01-0214:59:04

CWE-200

[email protected]

web.nvd.nist.gov

cve-2013-7249

fat free crm

xml serialization

vulnerability

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.8%

JSON

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.

Affected configurations

NVD

Node

fatfreecrmfat_free_crmRange≤0.12.0

fatfreecrmfat_free_crmMatch0.9.6

fatfreecrmfat_free_crmMatch0.9.7

fatfreecrmfat_free_crmMatch0.9.8

fatfreecrmfat_free_crmMatch0.9.9

fatfreecrmfat_free_crmMatch0.9.10

fatfreecrmfat_free_crmMatch0.10.1

fatfreecrmfat_free_crmMatch0.11.0

fatfreecrmfat_free_crmMatch0.11.1

fatfreecrmfat_free_crmMatch0.11.2

CPENameOperatorVersion
fatfreecrm:fat_free_crmfatfreecrm fat free crmle0.12.0
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.6
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.7
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.8
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.9
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.9.10
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.10.1
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.11.0
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.11.1
fatfreecrm:fat_free_crmfatfreecrm fat free crmeq0.11.2

CPE	Name	Operator	Version
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	le	0.12.0
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.6
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.7
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.8
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.9
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.9.10
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.10.1
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.11.0
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.11.1
fatfreecrm:fat_free_crm	fatfreecrm fat free crm	eq	0.11.2