Django Crm
Monthly
Missing authorization in the Django-CRM bulk case update endpoint (backend/cases/bulk_views.py) allows any authenticated member of an organization to edit, reassign, or close cases belonging to other users. Affected releases are django-crm 1.0 through 1.2; the same code path also skips the model's close-transition validation, so a case can be closed without the recorded approval that the single-case workflow requires. Version 1.3.0 resolves the issue (patch commit 799bb121), CVSS 4.0 rates it 5.3 (AV:N/AC:L/PR:L/UI:N), SSVC records no exploitation and no automatable vector, and no public exploit code has been identified at time of analysis.
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the Django-CRM bulk case update endpoint (backend/cases/bulk_views.py) allows any authenticated member of an organization to edit, reassign, or close cases belonging to other users. Affected releases are django-crm 1.0 through 1.2; the same code path also skips the model's close-transition validation, so a case can be closed without the recorded approval that the single-case workflow requires. Version 1.3.0 resolves the issue (patch commit 799bb121), CVSS 4.0 rates it 5.3 (AV:N/AC:L/PR:L/UI:N), SSVC records no exploitation and no automatable vector, and no public exploit code has been identified at time of analysis.
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.