GHSA-4xq9-vw89-p5cx

Fat Free CRM allows remote attackers to obtain sensitive information via a direct request

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-7224

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	fat_free_crm	< 0.12.1	0.12.1

Details

As written in the advisory (Markdown source, shown as plain text).

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.json`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-7224 advisory
https://github.com/fatfreecrm/fat_free_crm/issues/300 web
https://github.com/fatfreecrm/fat_free_crm/commit/cf26a04b356ad2161c4c6160260eb870a3de5328 web
https://github.com/fatfreecrm/fat_free_crm package
https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29 web
http://openwall.com/lists/oss-security/2013/12/28/2 web
http://seclists.org/fulldisclosure/2013/Dec/199 web