The disqualify lead action may be executed without CSRF token check

Moderate

rgrebenchuk published GHSA-vf7h-6246-hm43

Nov 18, 2021

Package

oro/crm (Composer)

Affected versions

>=3.1.0, <=3.1.24 || >=4.1.0, <=4.1.15 || >=4.2.0, <=4.2.5

Patched versions

4.2.7, 4.1.17

Description

Summary

The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack.

Workarounds

There are no workarounds that address this vulnerability.

Severity

Moderate

4.2

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L