CVE-2022-1411

    Dashboard / Vulnerabilities / CVE-2022-1411

    CVE-2022-1411

    Published: 5 May 2022Last Modified: 12 Aug 2026

    Summary: Unrestructed file upload in yetiforcecompany/yetiforcecrm

    Details: Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.

    References: https://huntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1411.json, https://nvd.nist.gov/vuln/detail/CVE-2022-1411, https://github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -212f7bd484bd9ca7e138e8e4a11e8cd561b3bea3

    Affected versions

    6.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1411 | CVE-DB