Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
YetiForce CRM Unrestricted Upload of File with Dangerous Type Vulnerability - CVE-2022-1411 - Vulnerability Database
YetiForce CRM

YetiForce CRM Unrestricted Upload of File with Dangerous Type Vulnerability - CVE-2022-1411

Medium
Reference: CVE-2022-1411
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-1411
Title: YetiForce CRM Unrestricted Upload of File with Dangerous Type Vulnerability
Overview:

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim39s cookie leads to account takeover.