CVE-2021-39198

    Dashboard / Vulnerabilities / CVE-2021-39198

    CVE-2021-39198

    Published: 19 Nov 2021Last Modified: 8 Jul 2026

    Summary:

    Details: OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

    References: https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ef6e3621ee08b97db11c2664546c6c979b86651a
    Fixed -None

    Affected versions

    4.2.5
    4.2.3
    4.2.2
    4.2.1
    4.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39198 | CVE-DB