PT-2019-11643 · Fat Free Crm · Fat Free Crm

Ismail Tasdelen · Published 2019-06-10 · Updated 2024-08-04 · CVE-2019-10226

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Fat Free CRM version 0.19.0

Description: A HTML Injection issue has been reported in the Fat Free CRM product, specifically via an authenticated request to the "/comments" URI. The vendor disputes the significance of this report, citing that some HTML formatting is allowed, and a XSS protection mechanism is in place. However, it's noted that certain HTML markup is sanitized when rendered to the page, allowing safe tags like <h1> but disallowing dangerous entities like <script> tags.

Recommendations: For Fat Free CRM version 0.19.0, consider restricting access to the "/comments" URI until the issue is resolved, as the vendor's dispute suggests the vulnerability may not be significant, but caution should still be exercised. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10226

GHSA-GMG5-R3C4-3FM9

Affected Products

Fat Free Crm

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2019-10226.yml · Exploit
• 🔥 https://exploit-db.com/exploits/46617 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10226 · Security Note
• https://osv.dev/vulnerability/GHSA-gmg5-r3c4-3fm9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10226 · Vendor Advisory
• https://github.com/fatfreecrm/fat_free_crm/issues/1235 · Note
• https://github.com/fatfreecrm/fat_free_crm/blob/master/app/views/comments/_comment.html.haml#L2 · Note
• https://github.com/fatfreecrm/fat_free_crm · Note
• https://github.com/github/advisory-database/pull/3599 · Note
• https://t.me/cvenotify/72165 · Telegram Post
• https://apidock.com/rails/ActionView/Helpers/TextHelper/simple_format · Note
• http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html · Note