GHSA-g897-cgfc-7q8v CVE-2013-7222

Fat Free CRM has fixed token value

Medium RubyGems

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 2.42%; Chance of exploitation in the next 30 days. Higher than 84.20% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-330 Use of Insufficiently Random Values
Fix: 0.12.1; Upgrade fat_free_crm to this version or later

Description

config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

Affected versions

RubyGems

Package	Vulnerable	Fixed in
fat_free_crm	`< 0.12.1`	`0.12.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

fat_free_crm RubyGems → `0.12.1`

bundler

bundle update fat_free_crm # Gemfile: gem "fat_free_crm", ">= 0.12.1"

Weakness

CWE-330: Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

How to prevent it

Architecture and Design: Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
Implementation: Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2013-7222

Packages

github.com/fatfreecrm/fat_free_crm

Timeline

May 17, 2022 Published
Nov 29, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-9pm8-vwc5-w2hm Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID	Low	Also affects fat_free_crm
GHSA-p75c-5x3h-cxcg Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint	Medium	Also affects fat_free_crm
GHSA-mcvq-7xjq-46x6 Fat Free CRM contains Cross-site Request Forgery vulnerablilities	Medium	Also affects fat_free_crm
GHSA-f25h-3mj6-4jpg Fat Free CRM vulnerable to Exposure of Sensitive Information	Medium	Also affects fat_free_crm
GHSA-9ggp-5rf4-x7q9 Fat Free CRM vulnerable to SQL Injection	Medium	Also affects fat_free_crm
GHSA-4xq9-vw89-p5cx Fat Free CRM allows remote attackers to obtain sensitive information via a direct request	Medium	Also affects fat_free_crm
GHSA-wcfx-3m6v-4frg Fat Free CRM subject to Cross-site Scripting	Medium	Also affects fat_free_crm
GHSA-wx7c-8j35-mpg8 Fat Free CRM Cross-Site Request Forgery vulnerability	Medium	Also affects fat_free_crm

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor