Back to Database
Status published
Medium
CVE-2019-10226
HTML Injection has been discovered in the v0.19.0 version of...
Vulnerability Description
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10226
Credits & Attribution
No credits recorded in the NVD database.
References
- http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html
- https://www.exploit-db.com/exploits/46617/
- https://github.com/fatfreecrm/fat_free_crm/issues/1235
- https://github.com/fatfreecrm/fat_free_crm/blob/master/app/views/comments/_comment.html.haml#L2
- https://apidock.com/rails/ActionView/Helpers/TextHelper/simple_format
More from fatfreecrm
View All →CVE-2022-39281
Remote Denial of Service via Tasks endpoint in fat_free_crm
Medium
6.5
CVE-2018-20975
Fat Free CRM before 0.18.1 has XSS in the tags_helper...
Medium
6.1
CVE-2018-1000842
FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0...
Medium
6.1
CVE-2015-1585
Fat Free CRM before 0.13.6 allows remote attackers to conduct...
Medium
6.8
CVE-2014-5441
Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free...
Medium
4.3
Affected Vendor
fatfreecrm
View all reports →Affected Software
fat free crm
Vulnerable Versions:
0.19.0
Timeline
Official Publish:
June 10th, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.