Moderate severityNVD Advisory· Published May 5, 2022· Updated Aug 3, 2024
Unrestructed file upload in yetiforcecompany/yetiforcecrm
CVE-2022-1411
Description
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
yetiforce/yetiforce-crmPackagist | < 6.4.0 | 6.4.0 |
Affected products
2- Range: unspecified
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-pqr6-3j58-9w58ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-1411ghsaADVISORY
- github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124ghsax_refsource_MISCWEB
- huntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.