GHSA-vf7h-6246-hm43

The disqualify lead action may be executed without CSRF token check

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-39198

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	oro/crm	>= 3.1.0, < 4.1.17	4.1.17
Packagist	oro/crm	>= 4.2.0, < 4.2.7	4.2.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. ### Workarounds There are no workarounds that address this vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43 web
https://nvd.nist.gov/vuln/detail/CVE-2021-39198 advisory
https://github.com/oroinc/crm package