-
-
Notifications
You must be signed in to change notification settings - Fork 216
/
CVE-2022-39281.yml
50 lines (42 loc) · 1.59 KB
/
CVE-2022-39281.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
---
gem: fat_free_crm
cve: 2022-39281
ghsa: p75c-5x3h-cxcg
url: https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg
title: Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint
date: 2022-10-07
description: |
### Impact
An authenticated user can perform a remote Denial of Service attack against
Fat Free CRM.
This vulnerability has been assigned the CVE identifier: CVE-2022-39281
Affected versions: All
Not affected: None
Fixed versions: 0.20.1
All users running an affected release should either upgrade or apply the patch
immediately.
### Releases
Fixed versions: 0.20.1 and above
### Patches
If you are unable to upgrade immediately, you should apply the following
patch.
```
diff --git a/app/models/polymorphic/task.rb b/app/models/polymorphic/task.rb
index d3d5c32c..7cdb24d6 100644
--- a/app/models/polymorphic/task.rb
+++ b/app/models/polymorphic/task.rb
@@ -189,6 +189,7 @@ class Task < ActiveRecord::Base
#----------------------------------------------------------------------------
def self.bucket_empty?(bucket, user, view = "pending")
return false if bucket.blank? || !ALLOWED_VIEWS.include?(view)
+ return false unless Setting.task_bucket.map(&:to_s).include?(bucket.to_s)
if view == "assigned"
assigned_by(user).send(bucket).pending.count
```
cvss_v3: 6.5
patched_versions:
- ">= 0.20.1"
related:
url:
- https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71
- https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1