VULNERABILITY INTELLIGENCE

CVE-2021-39198

CVSS score4.2 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2021-11-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

Description

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

Weakness classification

  • security-advisories@github.com: CWE-352
  • nvd@nist.gov: CWE-352

Primary references