CVE-2022-39281 Remote Denial of Service via Tasks endpoint in fat_free_crm
An authenticated user can cause a remote denial of service in Fat Free CRM via the Tasks endpoint, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39281?
CVE-2022-39281 is a medium-severity denial of service vulnerability in fatfreecrm fat_free_crm, published on 8 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
Weakness: CWE-20
Which versions are affected by CVE-2022-39281?
2 open source packages ship an affected version, including fat_free_crm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fat_free_crm RubyGems | All versions | 0.20.1 |
fat_free_crm RubyGems | All versions | 0.20.1 |
Products include Fatfreecrm Fatfreecrm.
How do I fix CVE-2022-39281?
Upgrade fat_free_crm to 0.20.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-39281 being exploited?
There is no known exploitation of CVE-2022-39281 in the wild and no public exploit code.
Other vulnerabilities in fatfreecrm fat_free_crm
Sources
Also known as GHSA-p75c-5x3h-cxcg.