JVN#97325754: F-RevoCRM vulnerable to cross-site scripting

F-RevoCRM provided by ThinkingReed inc. contains a cross-site scripting vulnerability (CWE-79).

Impact

An arbitrary script may be executed on the user’s web browser.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.

Apply Workaround
Applying the following workaround may mitigate the impact of this vulnerability.

• When viewing an untrusted website, be sure to log out from F-RevoCRM and/or use other web browsing application
• Restrict access to inappropriate websites by using Proxy server etc.

Products Affected

• F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series)