CVE-2022-3002 — Cross-site Scripting in Yetiforcecrm

CWE-79 — Cross-site ScriptingCWE-319 — Cleartext Transmission of Sensitive InfoCWE-347 — Improper Verification of Cryptographic SignatureCWE-294 — Authentication Bypass by Capture-replayCWE-863 — Incorrect AuthorizationCWE-732 — Incorrect Permission AssignmentCWE-287 — Improper Authentication14 documents7 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 42.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Yetiforcecompany YetiforcecrmYetiforce Customer Relationship ManagementSaltstack Salt+1 more
Timeline
PublishedOct 6
Latest updateDec 21

Description

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5yetiforcecompany/yetiforcecompany_yetiforcecrmunspecified — 6.4.0
▶PyPIsaltstack/salt3004 — 3004.1+5
▶Packagistyetiforce/yetiforce-crm6.4.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

8
CVEList
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm↗2022-10-06
▶
GHSA
YetiForce CRM vulnerable to stored Cross-site Scripting↗2022-10-06
▶
OSV
YetiForce CRM vulnerable to stored Cross-site Scripting↗2022-10-06
▶
GHSA
Salt's PAM auth fails to reject locked accounts↗2022-06-25
▶
GHSA
SaltStack Improper Verification of Cryptographic Signature↗2022-03-30
▶

📋Vendor Advisories

3
Red Hat
curl: HSTS bypass via IDN↗2022-12-21
▶
Red Hat
curl: HSTS bypass via IDN↗2022-10-26
▶
Microsoft
In curl before 7.86.0 the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support curl can be instructed to use HTTPS directly (instead of using an insecure cleartext H↗2022-10-11
▶
CVE-2022-3002 — Cross-site Scripting in Yetiforcecrm | cvebase