CVE-2021-4092 — Cross-Site Request Forgery in Yetiforcecrm

CWE-352 — Cross-Site Request Forgery4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 73.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Yetiforcecompany YetiforcecrmYetiforce Customer Relationship ManagementYetiforce Yetiforce-crm
Timeline
PublishedDec 11
Latest updateDec 16

Description

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5yetiforcecompany/yetiforcecompany_yetiforcecrmunspecified — 6.3.0
▶Packagistyetiforce/yetiforce-crm< 6.3.0

Patches

Patch: github.com ↗Patch: huntr.dev ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)↗2021-12-16
▶
GHSA
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)↗2021-12-16
▶
CVEList
Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm↗2021-12-11
▶
CVE-2021-4092 — Cross-Site Request Forgery | cvebase