GitHub Advisoryadvisory · Packagist

GHSA-7g7r-gr46-q4p5 Cross-Site Request Forgery in yetiforce

HIGH Published 2022-01-27 Modified 2022-01-31 Official page ↗
Aliases
CVE-2022-0269
Ecosystem
Packagist
Packages
yetiforce/yetiforce-crm
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-01-25

Affected packages

• Packagist yetiforce/yetiforce-crm: <= 6.3.0 (no fix yet)

Description

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.

Related

Alias · CVE (1)

  • CVE-2022-0269 Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References