CVE-2022-1411CWE-434

Unrestructed file upload in yetiforcecompany/yetiforcecrm

Critical · published May 5, 2022

CVSS v3.0
9.1
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.

The record
Technical detail
CVSS v3.0
9.1 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00761 · 54.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-05-05T10:30Z
EPSS history
Timeline
  • 05 MAY 10:30Z
    Unrestructed file upload in yetiforcecompany/yetiforcecrm
    cvelistv5