What is GHSA-7g7r-gr46-q4p5?

GHSA-7g7r-gr46-q4p5 is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Request Forgery in yetiforce

Which CVE IDs does GHSA-7g7r-gr46-q4p5 cover?

GHSA-7g7r-gr46-q4p5 covers the following CVE IDs: CVE-2022-0269. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7g7r-gr46-q4p5?

GHSA-7g7r-gr46-q4p5 has a CVSS v3 base score of 8.0, published by GitHub Security Advisories.

Which products are affected by GHSA-7g7r-gr46-q4p5?

GHSA-7g7r-gr46-q4p5 affects 1 product, including: composer/yetiforce/yetiforce-crm:\u003c= 6.3.0.

GHSA-7g7r-gr46-q4p5HighCVSS 8.0

Cross-Site Request Forgery in yetiforce

Vendor

GitHub Security Advisories

Published

January 27, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-0269 →

📋 Description

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.

🎯 Affected products1

composer/yetiforce/yetiforce-crm:<= 6.3.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-0269
https://github.com/yetiforcecompany/yetiforcecrm/commit/298c7870e6fe4332d8aa1757a9c8d79f841389ff
https://huntr.dev/bounties/a0470915-f6df-45b8-b3a2-01aebe764df0
https://github.com/advisories/GHSA-7g7r-gr46-q4p5