Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-39281

Good to know:

icon

Date: October 7, 2022

fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit "c85a254" and will be available in release "0.20.1". Users are advised to upgrade or to manually apply patch "c85a254". There are no known workarounds for this issue.

Language: Ruby

Severity Score

Related Resources (7)

https://github.com/fatfreecrm/fat_free_crm
https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1
https://nvd.nist.gov/vuln/detail/CVE-2022-39281
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2022-39281.yml
https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71
https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg
https://www.mend.io/vulnerability-database/CVE-2022-39281

Severity Score

Weakness Type (CWE)

Improper Input Validation

CWE-20

Insufficient Information

NVD-CWE-noinfo

Top Fix

icon

Upgrade Version

Upgrade to version fat_free_crm - 0.20.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us