Cross-Site Request Forgery in yetiforce

2022-01-2716:21:33

Google

osv.dev

0.001 Low

EPSS

Percentile

40.6%

JSON

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.

CPENameOperatorVersion
yetiforce/yetiforce-crmeq5.1.0
yetiforce/yetiforce-crmeq6.0.0
yetiforce/yetiforce-crmeq4.4.0_RC2
yetiforce/yetiforce-crmeq6.1.0
yetiforce/yetiforce-crmeq4.0.0
yetiforce/yetiforce-crmeq4.3.0
yetiforce/yetiforce-crmeq4.4.0_RC1
yetiforce/yetiforce-crmeq5.0.0
yetiforce/yetiforce-crmeq5.2.0
yetiforce/yetiforce-crmeq4.1.0

Name	Operator	Version
yetiforce/yetiforce-crm	eq	5.1.0
yetiforce/yetiforce-crm	eq	6.0.0
yetiforce/yetiforce-crm	eq	4.4.0_RC2
yetiforce/yetiforce-crm	eq	6.1.0
yetiforce/yetiforce-crm	eq	4.0.0
yetiforce/yetiforce-crm	eq	4.3.0
yetiforce/yetiforce-crm	eq	4.4.0_RC1
yetiforce/yetiforce-crm	eq	5.0.0
yetiforce/yetiforce-crm	eq	5.2.0
yetiforce/yetiforce-crm	eq	4.1.0