CVE-2021-39198

The disqualify lead action may be executed without CSRF token check

State: Published
Severity: 4.2 Medium
Published: Nov 19, 2021
Updated: Aug 4, 2024
Reserved: Aug 16, 2021

Description

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L	GitHub_M

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
crmoroinc	>=4.2.0, < 4.2.7Affected < 4.1.17Affected

References

https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.