CVE-2022-1411
Unrestructed file upload in yetiforcecompany/yetiforcecrm
Vexday Risk Score
28Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 9.1EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
05 may 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Productos afectados
yetiforcecompany · yetiforcecompany/yetiforcecrm¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →