CVE-2013-7223

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a `protect_from_forgery` line in `app/controllers/application_controller.rb`.

How to fix CVE-2013-7223

To remediate CVE-2013-7223, upgrade the affected package to a fixed version below.

• RubyGems/fat_free_crm—upgrade to 0.12.1 or later

Is CVE-2013-7223 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.12.1

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-7223
• PATCHgithub.com/fatfreecrm/fat_free_crm
• WEBopenwall.com/lists/oss-security/2013/12/28/2
• WEBseclists.org/fulldisclosure/2013/Dec/199
• WEB