CVE-2021-39198 The disqualify lead action may be executed without CSRF token check

OroCRM is an open source Client Relationship Management CRM application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery CSRF attack. There are no workarounds that address this vulnerability and all...

CVE-2021-39198

CVE-2021-39198 affects OroCRM. Multiple sources confirm a CSRF flaw that allows an attacker to disqualify a Lead via the disqualifyAction without a valid CSRF token. Root cause cited in Veracode advisories as an insufficient permissions check in the action handler. Impact is scaleable: leads can ...