p PatchFirst

CVE-2021-39198

CVE-2021-39198 · The disqualify lead action may be executed without CSRF token check

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

CVSS 4.2 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • crm

    Versions
    • >=4.2.0, < 4.2.7: Affected
    • < 4.1.17: Affected

    No fix published

  • oro/crm Packagist

    Versions
    • 3.1.0
    • 3.1.1
    • 3.1.10
    • 3.1.11
    • 3.1.12
    • 3.1.13
    • 3.1.14
    • 3.1.15
    • 3.1.16
    • 3.1.17
    • 3.1.2
    • 3.1.3
    • 3.1.4
    • 3.1.5
    • 3.1.6
    • 3.1.7
    • 3.1.8
    • 3.1.9
    • 4.0.0
    • 4.0.0-beta
    • 4.0.0-rc
    • 4.1.0
    • 4.1.0-beta
    • 4.1.0-rc
    • 4.1.0-rc4
    • 4.1.1
    • 4.1.1-rc
    • 4.1.10
    • 4.1.11
    • 4.1.12
    • 4.1.13
    • 4.1.2
    • 4.1.3
    • 4.1.4
    • 4.1.5
    • 4.1.6
    • 4.1.7
    • 4.1.8
    • 4.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 3.1.0, < 4.1.17

    Update to 4.1.17

  • oro/crm Packagist

    Versions
    • 4.2.0
    • 4.2.1
    • 4.2.2
    • 4.2.3
    • 4.2.4
    • 4.2.5
    • 4.2.6
    Affected ranges
    • ECOSYSTEM: ≥ 4.2.0, < 4.2.7

    Update to 4.2.7

Original sources

Check your server →