by Kastro
Paper/Archive/CVE-2022-1411

CVE-2022-1411

yetiforcecompany yetiforcecompany/yetiforcecrm — Unrestructed file upload in yetiforcecompany/yetiforcecrm

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 55.3.553 × 2011.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.

Affected

ProductAffectedFixed inSource
yetiforcecompany/yetiforcecrmunspecified – < 6.4.06.4.0CNA

Scores by source

@huntrdev (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

References

refhuntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529refgithub.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124