Cross site request forgery (csrf)

2021-11-1922:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

21.7%

JSON

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

CPENameOperatorVersion
client_relationship_managementge4.2.0
client_relationship_managementle4.2.5
client_relationship_managementge4.1.0
client_relationship_managementle4.1.15
client_relationship_managementge3.1.0
client_relationship_managementle3.1.24

Name	Operator	Version
client_relationship_management	ge	4.2.0
client_relationship_management	le	4.2.5
client_relationship_management	ge	4.1.0
client_relationship_management	le	4.1.15
client_relationship_management	ge	3.1.0
client_relationship_management	le	3.1.24

References

github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43

0.001 Low

EPSS

Percentile

21.7%

JSON

Related for PRION:CVE-2021-39198