high8.0
CVE-2022-0269
Cross-Site Request Forgery in yetiforce
Impact
Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | yetiforce/yetiforce-crm | <= 6.3.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yetiforce | Yetiforce Customer Relationship Management | before 6.3.0 |