Medium severity6.1NVD Advisory· Published May 5, 2022· Updated Jun 17, 2026
CVE-2022-1411
CVE-2022-1411
Description
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
yetiforce/yetiforce-crmPackagist | < 6.4.0 | 6.4.0 |
Affected products
3- cpe:2.3:a:yetiforce:yetiforce_customer_relationship_management:*:*:*:*:*:*:*:*Range: <6.4.0
- Range: unspecified
Patches
Vulnerability mechanics
References
4- github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124nvdPatchThird Party AdvisoryWEB
- huntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-pqr6-3j58-9w58ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-1411ghsaADVISORY
News mentions
0No linked articles in our index yet.