GHSA-VF7H-6246-HM43 The disqualify lead action may be executed without CSRF token check

Summary The attacker is able to disqualify any Lead with a Cross-Site Request Forgery CSRF attack. Workarounds There are no workarounds that address this vulnerability...

CVE-2021-39198: Cross-Site Request Forgery (CSRF)

OroCRM is an open source Client Relationship Management CRM application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery CSRF attack. There are no workarounds that address this vulnerability and all...