PT-2018-12489 · Creme · Creme Crm

Publicado 2018-09-07 · Atualizado 2018-11-14 · CVE-2018-14398

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Creme CRM version 1.6.12

Description An issue was discovered where the value of the cancel button uses the content of the HTTP Referer header. This could be used to trick a user into visiting a fake login page in order to steal credentials.

Recommendations For Creme CRM version 1.6.12, consider disabling the cancel button functionality until a patch is available to prevent potential credential theft.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2018-14398

Produtos afetados

Creme Crm

Referências · 3

• 🔥 https://bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-14398 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14398 · Nota de Segurança