Lucene search
RubySecRUBY:FAT_FREE_CRM-2013-7222-101445HistoryDec 23, 2013 - 8:00 p.m.
Fat Free CRM Gem for Ruby lack of support for cycling the Rails session secret
2013-12-2320:00:00
RubySec
nvd.nist.gov
7
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
0.006
Percentile
79.0%
Fat Free CRM contains a flaw that is due to the application defining a static
security session token in config/initialiers/secret_token.rb. If a remote
attacker has explicit knowledge of this token, they can potentially execute
arbitrary code.
Affected configurations
Node
rubyfat_free_crmRange≤0.13.0
ORrubyfat_free_crmRange0.12.0–0.12.1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ruby | fat_free_crm | * | cpe:2.3:a:ruby:fat_free_crm:*:*:*:*:*:*:*:* |
References
Related
github
github
Fat Free CRM has fixed token value
2022-05-17 04:55:27
osv
osv
Fat Free CRM has fixed token value
2022-05-17 04:55:27
prion
prion
Code injection
2014-01-02 14:59:00
cvelist
cvelist
CVE-2013-7222
2014-01-02 11:00:00
cve
cve
CVE-2013-7222
2014-01-02 14:59:04
nvd
nvd
CVE-2013-7222
2014-01-02 14:59:04
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
0.006
Percentile
79.0%
Related for RUBY:FAT_FREE_CRM-2013-7222-101445