CVE-2014-5441
Fat Free CRM subject to Cross-site Scripting
EPSS 1.9%
Description
Multiple cross-site scripting (XSS) vulnerabilities in `app/views/layouts/application.html.haml` in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.
How to fix CVE-2014-5441
To remediate CVE-2014-5441, upgrade the affected package to a fixed version below.
- RubyGems/fat_free_crm—upgrade to 0.13.3 or later
Is CVE-2014-5441 being exploited?
Low — EPSS is 1.9%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 0.11.1, < 0.13.3