Cross-Site Request Forgery Vulnerabilities in Fat Free CRM by Fat Free CRM
CVE-2013-7223

Currently unrated

Key Information:

Vendor

Fatfreecrm

Status
Fat Free Crm
Vendor
CVE Published:
2 January 2014

What is CVE-2013-7223?

Multiple cross-site request forgery (CSRF) vulnerabilities exist in Fat Free CRM versions prior to 0.12.1. These vulnerabilities allow remote attackers to hijack the authentication of unsuspecting users through various unknown vectors. This is primarily due to the absence of the necessary protect_from_forgery directive in the application controller, which serves as a critical safeguard against such attacks. Addressing these security issues is essential to protect user sessions and maintain the integrity of the application.

References

https://github.com/fatfreecrm/fat_free_crm/commit/a7fedbb...
x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2013/Dec/199
mailing-listx_refsource_FULLDISC
http://openwall.com/lists/oss-security/2013/12/28/2
mailing-listx_refsource_MLIST

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.