Cross-site Request Forgery (CSRF) Affecting fat_free_crm package, versions < 0.12.1

Snyk CVSS

Attack Complexity Low

User Interaction Required

Threat Intelligence

EPSS 0.72% (81^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-RUBY-FATFREECRM-20133
published 23 Dec 2013
disclosed 23 Dec 2013
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 23 Dec 2013

CVE-2013-7223 Open this link in a new tab CWE-352 Open this link in a new tab

Overview

fat_free_crm is an open source, Ruby on Rails customer relationship management platform. Affected versions of this gem are vulnerable to Cross-site Request Forgery (CSRF/XSRF).

Details

fat_free_crm is missing the protect_from_forgery statement. It does not require multiple steps, explicit confirmation, or a unique token when performing HTTP requests to app/controllers/application_controller.rb. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-site Request Forgery (CSRF/XSRF) attack causing the victim to perform unspecified actions.