GitHub Advisoryadvisory · PyPI

GHSA-pg2f-r7pc-6fxx Cross-Site Request Forgery in MicroPyramid Django CRM

HIGH Published 2019-09-11 Modified 2024-09-16 Official page ↗
Aliases
CVE-2019-11457
Ecosystem
PyPI
Packages
django-crm
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2019-08-28

Affected packages

• PyPI django-crm: <= 0.2.1 (no fix yet)

Description

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.

Related

Alias · CVE (1)

  • CVE-2019-11457 Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/,… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References