Design/Logic Flaw

2018-09-0722:29:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.3%

JSON

An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake login page in order to steal credentials.

CPENameOperatorVersion
cremecrmeq1.6.12

CPE	Name	Operator	Version
	cremecrm	eq	1.6.12

References

www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/