CVE-2022-39281.yml

---
gem: fat_free_crm
cve: 2022-39281
ghsa: p75c-5x3h-cxcg
url: https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg
title: Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint
date: 2022-10-07
description: |
  ### Impact
  An authenticated user can perform a remote Denial of Service attack against
  Fat Free CRM.

  This vulnerability has been assigned the CVE identifier: CVE-2022-39281

  Affected versions: All
  Not affected: None
  Fixed versions: 0.20.1

  All users running an affected release should either upgrade or apply the patch
  immediately.

  ### Releases
  Fixed versions: 0.20.1 and above

  ### Patches

  If you are unable to upgrade immediately, you should apply the following
  patch.

  ```
  diff --git a/app/models/polymorphic/task.rb b/app/models/polymorphic/task.rb
  index d3d5c32c..7cdb24d6 100644
  --- a/app/models/polymorphic/task.rb
  +++ b/app/models/polymorphic/task.rb
  @@ -189,6 +189,7 @@ class Task < ActiveRecord::Base
     #----------------------------------------------------------------------------
     def self.bucket_empty?(bucket, user, view = "pending")
       return false if bucket.blank? || !ALLOWED_VIEWS.include?(view)
  +    return false unless Setting.task_bucket.map(&:to_s).include?(bucket.to_s)

       if view == "assigned"
         assigned_by(user).send(bucket).pending.count
  ```
cvss_v3: 6.5
patched_versions:
  - ">= 0.20.1"
related:
  url:
    - https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71
    - https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1