GHSA-7g7r-gr46-q4p5

Cross-Site Request Forgery in yetiforce

Source: GitHub Advisory Database (reviewed) High CVE-2022-0269

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	yetiforce/yetiforce-crm	<= 6.3.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0269 advisory
https://github.com/yetiforcecompany/yetiforcecrm/commit/298c7870e6fe4332d8aa1757a9c8d79f841389ff web
https://github.com/yetiforcecompany/yetiforcecrm web
https://huntr.dev/bounties/a0470915-f6df-45b8-b3a2-01aebe764df0 web