What is the CVSS score of CVE-2013-7222?

CVE-2013-7222 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2013-7222?

Yes, a public proof-of-concept exploit is available for CVE-2013-7222. Prioritise patching immediately. EPSS: 0.6%.

Is there a patch available for CVE-2013-7222?

Yes, a patch is available for CVE-2013-7222. Update the affected software to the latest version immediately.

Fat Free Crm CVE-2013-7222

MEDIUM

Cryptographic Issues (CWE-310)

2014-01-02 cve@mitre.org

Information Disclosure Fat Free Crm

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Jan 02, 2014 - 14:59 cve.org

MEDIUM 5.0

DescriptionCVE.org

config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-310. config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code. Affected products include: Fatfreecrm Fat Free Crm. Version information: before 0.12.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.