CVE-2023-49508: YetiForceCRM Directory Traversal Vulnerability
Summary
CVE-2023-49508: YetiForceCRM Directory Traversal vulnerability. Affects yetiforce/yetiforce-crm versions < 6.5.0. Fixed in 6.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
YetiForceCRM is an open-source customer relationship management (CRM) software that provides a comprehensive suite of tools for managing customer interactions, sales, and marketing. It is designed to be flexible and customizable, catering to various business needs. However, certain versions of YetiForceCRM, specifically versions 6.4.0 and earlier, are vulnerable to a directory traversal issue that can expose sensitive information to authenticated attackers.
Vulnerability Detail
The directory traversal vulnerability in YetiForceCRM arises from improper validation of user input in the LibraryLicense.php component. By manipulating the 'license' parameter, an authenticated attacker can traverse the directory structure of the server, potentially gaining access to sensitive files and information that should be protected. This vulnerability is classified under CWE-22 and has a CVSS score of 6.5, indicating a moderate severity level. If exploited, it could lead to unauthorized access to critical data, posing significant risks to the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
6.5.0
This is the first release that contains the fix.
composer require yetiforce/yetiforce-crm:6.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the LibraryLicense.php file by modifying your web server configuration to prevent unauthorized access. However, this is not a permanent solution and should be followed by an update to the patched version as soon as possible.
Conclusion
The directory traversal vulnerability in YetiForceCRM poses a significant risk to users of versions 6.4.0 and earlier. It is crucial to update to version 6.5.0 or later to mitigate this risk. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities and ensure their systems remain secure.
See every vulnerability recorded for yetiforce/yetiforce-crm →
FAQ
A directory traversal vulnerability allows an attacker to access files and directories that are stored outside the web root folder, potentially exposing sensitive information.
Any user of YetiForceCRM versions 6.4.0 and earlier is at risk of this vulnerability, particularly those with authenticated access.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your composer.lock file, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, implement access restrictions to the vulnerable files as a temporary measure until you can apply the patch.
Failure to address this vulnerability could lead to unauthorized access to sensitive data, which may result in data breaches, loss of customer trust, and potential legal ramifications.
Related vulnerabilities
Recent vulnerabilities recorded for yetiforce/yetiforce-crm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
