Fat Free CRM has fixed token value

CVE-2013-7222 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2022-05-17 04:55:27 UTC
Updated: 2023-08-16 09:18:52 UTC
GitHub reviewed: 2023-01-23 14:33:19 UTC
NVD published: 2014-01-02

EPSS Score

Score	Percentile
0.62%	70.02%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type	Value
GHSA	GHSA-g897-cgfc-7q8v ↗
CVE	CVE-2013-7222 ↗

CWEs

CWE id	Name
CWE-330	Use of Insufficiently Random Values

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
rubygems	fat_free_crm	< 0.12.1	0.12.1	—

References

cvelogic Threat Intelligence