GitHub Advisoryadvisory · RubyGems

GHSA-mcvq-7xjq-46x6 Fat Free CRM contains Cross-site Request Forgery vulnerablilities

MEDIUM Published 2022-05-17 Modified 2023-01-23 Official page ↗
Aliases
CVE-2013-7223
Ecosystem
RubyGems
Packages
fat_free_crm
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2023-01-23

Affected packages

• RubyGems fat_free_crm: < 0.12.1 → fixed in 0.12.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a `protect_from_forgery` line in `app/controllers/application_controller.rb`.

Related

Alias · CVE (1)

  • CVE-2013-7223 Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References