PT-2021-22453 · Orocrm · Orocrm

Rgrebenchuk · Published 2021-11-19 · Updated 2021-11-23 · CVE-2021-39198

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OroCRM (affected versions not specified)

Description The issue allows an attacker to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this issue. All users are advised to update their package.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-39198

GHSA-VF7H-6246-HM43

Affected Products

Orocrm

References · 6

• https://osv.dev/vulnerability/CVE-2021-39198 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf7h-6246-hm43 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39198 · Security Note
• https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43 · Note
• https://github.com/oroinc/crm · Note
• https://t.me/cibsecurity/32751 · Telegram Post