CVE-2021-39198
1 advisory.
Packagist/oro/crm CVE-2021-39198: medium 4.2, EPSS 0.31%
The disqualify lead action may be executed without CSRF token check
Action: Upgrade oro/crm to 4.1.17 or later.
composer require oro/crm:4.1.17composer require oro/crm:4.2.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.1.0 | 4.1.17 | - |
| 4.2.0 | 4.2.7 | - |
Fixed versions
| 4.1.17 | 4.2.7 |
Sources
- osv: GHSA-vf7h-6246-hm43
- https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43
- https://nvd.nist.gov/vuln/detail/CVE-2021-39198
- https://github.com/oroinc/crm
CVE-2021-39198 · published · modified · JSON