Every CVESearch/Get API key

CVE-2013-7223

Fat Free CRM contains Cross-site Request Forgery vulnerablilities

6.8 MediumFix available

CVE-2013-7223 is a medium vulnerability (CVSS 6.8) in Fatfreecrm Fat Free Crm, published January 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in fat_free_crm 0.12.1.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
1.20%EPSS, 68th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.12.1fat_free_crm +1 more

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.

Exploit likelihood

1.20%Down 0.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fat_free_crm
RubyGems
before 0.12.1
0.12.1
fat_free_crm
RubyGems
before 0.12.1, plus listed versions
0.11.00.11.10.11.20.11.30.11.40.12.0
0.12.1

What each source reports

NVD Score used6.8

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.

Record
CVE-2013-7223
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-352
Updated
2026-11-02
CVE ListNo score

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.

Record
CVE-2013-7223
Updated
2026-11-02
EUVDEUVD-2022-4544No score

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.

Record
EUVD-2022-4544
Updated
2026-11-03
GitHub AdvisoriesGHSA-mcvq-7xjq-46x6No score

Fat Free CRM contains Cross-site Request Forgery vulnerablilities

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.

Record
GHSA-mcvq-7xjq-46x6
Weakness
CWE-352
Updated
2026-11-02
OSVGHSA-mcvq-7xjq-46x6No score

Fat Free CRM contains Cross-site Request Forgery vulnerablilities

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.

Record
GHSA-mcvq-7xjq-46x6
Weakness
CWE-352
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open