Yetiforce Customer Relationship Management CVE-2021-4092

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2021-12-11 security@huntr.dev

CSRF Yetiforce Customer Relationship Management

4.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Dec 11, 2021 - 14:15 nvd

MEDIUM 4.3

DescriptionNVD

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)

AnalysisAI

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) Affected products include: Yetiforce Yetiforce Customer Relationship Management.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Yetiforce Customer Relationship Management

View all

CVE-2022-1411 MEDIUM This Month POC

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium severity (CVSS

CVE-2021-4121 MEDIUM This Month POC

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rate

CVE-2021-4107 MEDIUM This Month POC

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rate

CVE-2022-3002 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium seve

CVE-2022-3005 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium seve

CVE-2022-3004 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium seve

CVE-2022-3000 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium seve

CVE-2022-2924 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3. Rated medium severi

CVE-2022-2829 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium seve

CVE-2022-2890 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium seve

CVE-2022-1340 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Rated medium seve

CVE-2021-4116 MEDIUM This Month POC

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rate

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all

CVE-2016-6277 HIGH POC

CVE-2014-100005 HIGH POC

CVE-2013-5696 MEDIUM POC

CVE-2020-36836 HIGH POC

CVE-2015-2295 MEDIUM POC

CVE-2016-6897 MEDIUM POC

CVE-2022-41622 HIGH POC

CVE-2025-2907 CRITICAL POC

Same technique CSRF

View all

CVE-2016-6277 HIGH POC

CVE-2014-100005 HIGH POC

CVE-2017-9757 HIGH POC

CVE-2013-5696 MEDIUM POC

CVE-2013-4152 MEDIUM POC

CVE-2024-7094 CRITICAL

CVE-2015-4624 HIGH POC

CVE-2020-36836 HIGH POC

Share

CVE-2021-4092 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy