The disqualify lead action may be executed without CSRF token check

2021-11-1920:18:54

Google

osv.dev

0.001 Low

EPSS

Percentile

21.7%

JSON

Summary

The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack.

Workarounds

There are no workarounds that address this vulnerability.

CPENameOperatorVersion
oro/crmeq4.0.0
oro/crmeq4.1.3
oro/crmeq4.2.4
oro/crmeq3.1.14
oro/crmeq3.1.13
oro/crmeq4.1.10
oro/crmeq3.1.11
oro/crmeq4.1.7
oro/crmeq3.1.3
oro/crmeq4.2.3

Name	Operator	Version
oro/crm	eq	4.0.0
oro/crm	eq	4.1.3
oro/crm	eq	4.2.4
oro/crm	eq	3.1.14
oro/crm	eq	3.1.13
oro/crm	eq	4.1.10
oro/crm	eq	3.1.11
oro/crm	eq	4.1.7
oro/crm	eq	3.1.3
oro/crm	eq	4.2.3

Rows per page:

1-10 of 461

References

github.com/oroinc/crm

github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43

nvd.nist.gov/vuln/detail/CVE-2021-39198

0.001 Low

EPSS

Percentile

21.7%

JSON

Related for OSV:GHSA-VF7H-6246-HM43