CVE-2022-3004: YetiForce CRM Stored Cross-site Scripting Vulnerability
Summary
CVE-2022-3004: YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module. Affects yetiforce/yetiforce-crm versions < 6.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
YetiForce CRM is an open-source customer relationship management (CRM) software designed to help businesses manage their sales, marketing, and customer support activities. It provides a wide range of features, including contact management, lead tracking, task management, and workflow automation. YetiForce CRM is widely used by organizations of all sizes to streamline their customer management processes.
YetiForce CRM versions 6.4.0 and prior are affected by a stored cross-site scripting (XSS) vulnerability in the WorkFlow module. This vulnerability allows an attacker to inject malicious scripts into the application, which can be executed by unsuspecting users. The vulnerability arises due to insufficient input sanitization and validation in the affected module.
Vulnerability Detail
The stored cross-site scripting (XSS) vulnerability in YetiForce CRM's WorkFlow module allows an attacker to inject malicious scripts into the application. This can be achieved by submitting specially crafted input, such as script tags or event handlers, through the affected module. When the injected script is rendered by the application, it is executed in the context of the victim's browser, potentially leading to various attacks, including session hijacking, defacement, or the theft of sensitive information.
The vulnerability has a CVSS score of 5.4, indicating a moderate severity level. It requires low attack complexity, but successful exploitation requires the attacker to have limited privileges within the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the WorkFlow module in YetiForce CRM. This can be achieved by modifying the application's configuration or access control settings to prevent users from accessing the vulnerable module. However, this workaround may impact the functionality of the CRM system, so it is recommended to apply the official patch as soon as possible.
Conclusion
YetiForce CRM versions 6.4.0 and prior are vulnerable to a stored cross-site scripting (XSS) vulnerability in the WorkFlow module. This vulnerability can be mitigated by applying the official patch provided by the project. Users should update their installation to a version that includes the patch, such as YetiForce CRM 6.4.1 or later. As a temporary workaround, users can disable or restrict access to the WorkFlow module. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for yetiforce/yetiforce-crm →
FAQ
YetiForce CRM is an open-source customer relationship management (CRM) software used by businesses to manage their sales, marketing, and customer support activities.
A stored cross-site scripting (XSS) vulnerability allows an attacker to inject malicious scripts into a web application. These scripts are then executed by unsuspecting users, potentially leading to various attacks.
The vulnerability allows an attacker to inject malicious scripts into the application, which can be executed by users who interact with the affected module. This can lead to attacks such as session hijacking, defacement, or the theft of sensitive information.
The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
Users should apply the available patch provided by the project. The patch can be obtained from the official GitHub repository by downloading the file associated with the commit cd82ecce44d83f1f6c10c7766bf36f3026de024a.
Related vulnerabilities
Recent vulnerabilities recorded for yetiforce/yetiforce-crm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
