Back to Database
Status published
Medium
CVE-2021-39198
The disqualify lead action may be executed without CSRF token check
Vulnerability Description
OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39198
Credits & Attribution
No credits recorded in the NVD database.
More from oroinc
View All →CVE-2023-48296
OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID
Medium
4.3
CVE-2023-45824
OroPlatform's pinned entity creation form shows pages of other users
Medium
4.3
CVE-2023-32065
OroCommerce get-totals-for-checkout API endpoint returns unwanted data
Medium
5.8
CVE-2023-32064
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Medium
5
CVE-2023-32063
OroCRMCallBundle has incorrect call view page visibility
Medium
5
Affected Vendor
oroinc
View all reports →Affected Software
crm
Vulnerable Versions:
>=4.2.0, < 4.2.7, < 4.1.17
Timeline
Official Publish:
November 19th, 2021
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L