CVE-2021-39198

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
oroinc	crm	>=4.2.0, < 4.2.7; < 4.1.17

References

https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43Third Party Advisory
https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43Third Party Advisory

Timeline

Published: Nov 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391996.1remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has ment CVE-2021-39205.4grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-392005.3WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio CVE-2021-392015.4WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The iss CVE-2021-392025.4WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio CVE-2021-392036.5WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio CVE-2021-392047.5Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams w CVE-2021-392056.1Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting v CVE-2021-392068.6Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilitie CVE-2021-392078.8parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the pac CVE-2021-392084.3SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to part CVE-2021-392098.8GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site R