Remote Information Disclosure in Fat Free CRM by Fat Free CRM Team
CVE-2013-7224

Currently unrated

Key Information:

Vendor: Fatfreecrm
Status: Fat Free Crm
Vendor: CVE Published:; 2 January 2014

What is CVE-2013-7224?

An information disclosure vulnerability exists in Fat Free CRM versions prior to 0.12.1, where insufficient restriction on JSON serialization allows remote attackers to access sensitive information. This can be exploited through direct requests, exemplified by accessing user data via specific endpoints, leading to potential data leaks and privacy breaches.

References

http://seclists.org/fulldisclosure/2013/Dec/199

mailing-listx_refsource_FULLDISC

http://openwall.com/lists/oss-security/2013/12/28/2

mailing-listx_refsource_MLIST

http://www.phenoelit.org/stuff/ffcrm.txt

x_refsource_MISC

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 2, 2014
Vulnerability Reserved
Dec 28, 2013

CVE-2013-7224 Data

JSON

Fatfreecrm

What is CVE-2013-7224?

References

Timeline