{"action":"Upgrade fat_free_crm to 0.14.2 or later.","affected":[{"fixed":"0.14.2","introduced":"0"},{"fixed":"0.15.2","introduced":"0.15.0"},{"fixed":"0.16.4","introduced":"0.16.0"},{"fixed":"0.17.3","introduced":"0.17.0"},{"fixed":"0.18.1","introduced":"0.18.0"}],"component":"fat_free_crm","cve_ids":["CVE-2018-1000842"],"ecosystem":"RubyGems","epss":0.01673,"exploited":false,"fixed_versions":["0.14.2","0.15.2","0.16.4","0.17.3","0.18.1"],"ghsa_id":"GHSA-j5rj-g695-342r","id":"tcs_01M5KEKSTC3M0R4ZJ0WVSAVF5V","modified_at":"2024-02-16T08:11:15.649513Z","published_at":"2018-12-20T22:01:54Z","references":["https://osv.dev/vulnerability/GHSA-j5rj-g695-342r","https://nvd.nist.gov/vuln/detail/CVE-2018-1000842","https://github.com/asteinhauser/fat_free_crm/issues/1","https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa","https://github.com/asteinhauser/fat_free_crm","https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2018-1000842.yml","https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-j5rj-g695-342r","url":"https://osv.dev/vulnerability/GHSA-j5rj-g695-342r"}],"summary":"Fat Free CRM vulnerable to Cross-site Scripting"}