CVE-2022-1411 describes an unrestricted file upload vulnerability in YetiForce CRM versions prior to 6.4.0. This flaw allows an unauthenticated attacker to upload malicious files, potentially leading to cross-site scripting (XSS) and account takeover by stealing user cookies. With a CVSS score of 6.1 (Medium), the vulnerability requires user interaction (UI:R) but can be exploited over the network (AV:N). While no public exploits or active exploitation have been observed, and community discussion is minimal, the potential for account compromise warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.4.0CPE matchmatch criteria | cpe:2.3:a:yetiforce:yetiforce_customer_relationship_management:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.