GHSA-9pm8-vwc5-w2hm
Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID
- Severity
- 0.0 / 10
- Low · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-639 Authorization Bypass Through User-Controlled Key
- Fix
0.26.0- Upgrade fat_free_crm to this version or later
Description
Impact
Authenticated users can delete emails imported into the system assigned to another user; where the Email Dropbox is in use.
Patches
Fixed in v0.26.0
Workarounds
Disable use of email dropbox.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| fat_free_crm | < 0.26.0 |
0.26.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fat_free_crm RubyGems → 0.26.0
- bundler
bundle update fat_free_crm # Gemfile: gem "fat_free_crm", ">= 0.26.0"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-639: Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
How to prevent it
- Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
- Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p75c-5x3h-cxcg Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint | Medium | Also affects fat_free_crm |
| GHSA-mcvq-7xjq-46x6 Fat Free CRM contains Cross-site Request Forgery vulnerablilities | Medium | Also affects fat_free_crm |
| GHSA-f25h-3mj6-4jpg Fat Free CRM vulnerable to Exposure of Sensitive Information | Medium | Also affects fat_free_crm |
| GHSA-g897-cgfc-7q8v Fat Free CRM has fixed token value | Medium | Also affects fat_free_crm |
| GHSA-9ggp-5rf4-x7q9 Fat Free CRM vulnerable to SQL Injection | Medium | Also affects fat_free_crm |
| GHSA-4xq9-vw89-p5cx Fat Free CRM allows remote attackers to obtain sensitive information via a direct request | Medium | Also affects fat_free_crm |
| GHSA-wcfx-3m6v-4frg Fat Free CRM subject to Cross-site Scripting | Medium | Also affects fat_free_crm |
| GHSA-wx7c-8j35-mpg8 Fat Free CRM Cross-Site Request Forgery vulnerability | Medium | Also affects fat_free_crm |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor