Remote Cookie Spoofing Vulnerability in Fat Free CRM
CVE-2013-7222

Currently unrated

Key Information:

Vendor

Fatfreecrm

Status
Fat Free Crm
Vendor
CVE Published:
2 January 2014

What is CVE-2013-7222?

The vulnerability found in Fat Free CRM arises from a hardcoded value in the configuration file that sets the 'secret_token' parameter. This presents a risk where attackers can exploit this fixed value to spoof signed cookies, potentially leading to unauthorized access and manipulation of user sessions. It is crucial for users of Fat Free CRM to update to version 0.12.1 or later to mitigate this vulnerability.

References

https://github.com/fatfreecrm/fat_free_crm/commit/93c182d...
x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2013/Dec/199
mailing-listx_refsource_FULLDISC
http://openwall.com/lists/oss-security/2013/12/28/2
mailing-listx_refsource_MLIST

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.