GHSA-f25h-3mj6-4jpg

Suggest an improvement
Source
https://github.com/advisories/GHSA-f25h-3mj6-4jpg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f25h-3mj6-4jpg/GHSA-f25h-3mj6-4jpg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f25h-3mj6-4jpg
Aliases
  • CVE-2013-7249
Published
2022-05-17T04:55:27Z
Modified
2024-12-03T06:07:51Z
Summary
Fat Free CRM vulnerable to Exposure of Sensitive Information
Details

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.

Database specific 
{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-01-23T14:44:47Z",
    "nvd_published_at":  "2014-01-02T14:59:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / fat_free_crm

Package

Name
fat_free_crm
Purl
pkg:gem/fat_free_crm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.1

Affected versions

0.*
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f25h-3mj6-4jpg/GHSA-f25h-3mj6-4jpg.json"