medium4.2
CVE-2021-39198
The disqualify lead action may be executed without CSRF token check
Impact
### Summary The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. ### Workarounds There are no workarounds that address this vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | oro/crm | >= 3.1.0, < 4.1.17 | 4.1.17 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oroinc | Client Relationship Management | from 3.1.0 through 3.1.24 from 4.1.0 through 4.1.15 from 4.2.0 through 4.2.5 |