GitHub Advisoryadvisory · RubyGems

GHSA-wcfx-3m6v-4frg Fat Free CRM subject to Cross-site Scripting

MEDIUM Published 2022-05-17 Modified 2023-01-23 Official page ↗
Aliases
CVE-2014-5441
Ecosystem
RubyGems
Packages
fat_free_crm
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-01-23

Affected packages

• RubyGems fat_free_crm: >= 0.11.1, < 0.13.3 → fixed in 0.13.3

Description

Multiple cross-site scripting (XSS) vulnerabilities in `app/views/layouts/application.html.haml` in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.

Related

Alias · CVE (1)

  • CVE-2014-5441 Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References