Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.
References:GSA_kwCzR0hTQS03ZzdyLWdyNDYtcTRwNc0mJA
Cross-Site Request Forgery in yetiforce
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:yetiforce/yetiforce-crm | <= 6.3.0 | No known fixed version | |
Affected Version RangesAll affected versions4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 6.0.0, 6.1.0, 6.2.0, 6.3.0 |
|||