What is GHSA-pg2f-r7pc-6fxx?

GHSA-pg2f-r7pc-6fxx is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Request Forgery in MicroPyramid Django CRM

Which CVE IDs does GHSA-pg2f-r7pc-6fxx cover?

GHSA-pg2f-r7pc-6fxx covers the following CVE IDs: CVE-2019-11457. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pg2f-r7pc-6fxx?

GHSA-pg2f-r7pc-6fxx has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-pg2f-r7pc-6fxx?

GHSA-pg2f-r7pc-6fxx affects 1 product, including: pip/django-crm:\u003c= 0.2.1.

GHSA-pg2f-r7pc-6fxxHighCVSS 8.8

Cross-Site Request Forgery in MicroPyramid Django CRM

Vendor

GitHub Security Advisories

Published

September 11, 2019

Last Modified

September 16, 2024

🔗 CVE IDs covered (1)

CVE-2019-11457 →

📋 Description

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.

🎯 Affected products1

pip/django-crm:<= 0.2.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-11457
http://packetstormsecurity.com/files/154219/Django-CRM-0.2.1-Cross-Site-Request-Forgery.html
http://seclists.org/fulldisclosure/2019/Aug/30
https://github.com/advisories/GHSA-pg2f-r7pc-6fxx
https://github.com/pypa/advisory-database/tree/main/vulns/django-crm/PYSEC-2019-174.yaml
https://www.netsparker.com/blog/web-security