CVE-2022-3005: YetiForce CRM Stored Cross-site Scripting Vulnerability
Summary
CVE-2022-3005: YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module. Affects yetiforce/yetiforce-crm versions < 6.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
YetiForce CRM is an open-source customer relationship management (CRM) software designed to help businesses manage their sales, marketing, and customer support activities. It provides a wide range of features, including contact management, lead tracking, task management, and reporting. YetiForce CRM is widely used by organizations to streamline their customer relationship management processes. However, versions 6.4.0 and prior are vulnerable to a stored cross-site scripting (XSS) vulnerability in the SlaPolicy module.
Vulnerability Detail
The stored XSS vulnerability in the SlaPolicy module of YetiForce CRM allows an attacker to inject malicious scripts into the application, which are then executed when viewed by other users. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and phishing attacks. The vulnerability originates from insufficient input validation and sanitization of user-supplied data in the SlaPolicy module. An attacker can exploit this vulnerability by crafting a specially crafted payload and submitting it through the affected module. When other users view the affected page, the malicious script is executed in their browsers, potentially compromising their accounts and exposing them to further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to the latest version is not immediately possible, a temporary workaround is to disable or restrict access to the SlaPolicy module. This can be done by modifying the application's configuration or access control settings to prevent users from accessing the vulnerable module. However, this is only a temporary solution, and it is strongly recommended to update to the latest version as soon as possible.
Conclusion
YetiForce CRM versions 6.4.0 and prior are vulnerable to a stored cross-site scripting (XSS) vulnerability in the SlaPolicy module. It is crucial for users of YetiForce CRM to update to version 6.4.1 or later, which includes a patch for this vulnerability. If immediate update is not possible, restricting access to the vulnerable module can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yetiforce/yetiforce-crm →
FAQ
YetiForce CRM is an open-source customer relationship management software used by businesses to manage their sales, marketing, and customer support activities.
The SlaPolicy module in YetiForce CRM is responsible for managing service level agreements (SLAs) and defining policies for customer support.
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then executed when viewed by other users.
The potential risks of this vulnerability include unauthorized access to sensitive information, session hijacking, and phishing attacks.
To protect your YetiForce CRM installation, it is recommended to update to the latest version, apply the provided patch, and regularly update the software to ensure the latest security fixes are applied.
Related vulnerabilities
Recent vulnerabilities recorded for yetiforce/yetiforce-crm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
