GHSA-g897-cgfc-7q8v

Fat Free CRM has fixed token value

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-7222

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	fat_free_crm	< 0.12.1	0.12.1

Details

As written in the advisory (Markdown source, shown as plain text).

`config/initializers/secret_token.rb` in Fat Free CRM before 0.12.1 has a fixed `FatFreeCRM::Application.config.secret_token` value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-7222 advisory
https://github.com/fatfreecrm/fat_free_crm/issues/300 web
https://github.com/fatfreecrm/fat_free_crm/commit/93c182dd4c6f3620b721d2a15ba6a6ecab5669df web
https://github.com/fatfreecrm/fat_free_crm package
https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2013-7222.yml web
http://openwall.com/lists/oss-security/2013/12/28/2 web
http://seclists.org/fulldisclosure/2013/Dec/199 web