GitHub Advisoryadvisory · RubyGems

GHSA-f25h-3mj6-4jpg Fat Free CRM vulnerable to Exposure of Sensitive Information

MEDIUM Published 2022-05-17 Modified 2023-01-23 Official page ↗
Aliases
CVE-2013-7249
Ecosystem
RubyGems
Packages
fat_free_crm
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-01-23

Affected packages

• RubyGems fat_free_crm: < 0.12.1 → fixed in 0.12.1

Description

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.xml`, a different vulnerability than CVE-2013-7224.

Related

Alias · CVE (1)

  • CVE-2013-7249 Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References