CVE-2022-1411
Summary
| CVE | CVE-2022-1411 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-05 11:15:00 UTC |
| Updated | 2022-05-12 20:41:00 UTC |
| Description | Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover. |
Risk And Classification
Problem Types: CWE-434
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Yetiforce | Yetiforce Customer Relationship Management | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| huntr – Security Bounties for any GitHub repository | CONFIRM | huntr.dev | |
| Added validation to pasted files to the wysiwyg editor · YetiForceCompany/YetiForceCRM@bf69c42 · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.