The disqualify lead action may be executed without CSRF token check
Priority LOW 24CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.
Summary
OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.
Why it matters now
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed crm (oroinc): 4.2.7, 4.1.17oro/crm (Packagist): 4.1.17, 4.2.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oroinc | crm | 4.2.0 to before 4.2.7; before 4.1.17 | 4.2.7, 4.1.17 | Patch available | CNA |
| — | oro/crm (Packagist) | 3.1.0 to before 4.1.17 | 4.1.17 | Patch available | GHSA-vf7h-6246-hm43 |
| — | oro/crm (Packagist) | 4.2.0 to before 4.2.7 | 4.2.7 | Patch available | GHSA-vf7h-6246-hm43 |
- crm Vendororoinc Affected 4.2.0 to before 4.2.7; before 4.1.17 Fixed in 4.2.7, 4.1.17 Patch available CNA
- oro/crm (Packagist) Vendor— Affected 3.1.0 to before 4.1.17 Fixed in 4.1.17 Patch available GHSA-vf7h-6246-hm43
- oro/crm (Packagist) Vendor— Affected 4.2.0 to before 4.2.7 Fixed in 4.2.7 Patch available GHSA-vf7h-6246-hm43
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:* | 3.1.0 – 3.1.24; 4.1.0 – 4.1.15; 4.2.0 – 4.2.5 | Vulnerable | oroinc |
- cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:* Versions 3.1.0 – 3.1.24; 4.1.0 – 4.1.15; 4.2.0 – 4.2.5 Vulnerable ·oroinc
Remediation
- Fix · CNA crm (oroinc) Fixed in 4.2.7, 4.1.17
- Fix · GHSA-vf7h-6246-hm43 oro/crm (Packagist) Fixed in 4.1.17 Advisory →
- Fix · GHSA-vf7h-6246-hm43 oro/crm (Packagist) Fixed in 4.2.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39198
- 2026-10-03 Alias added: GHSA-vf7h-6246-hm43
References
More oroinc Client Relationship Management vulnerabilities
- TI-2023-15367 OroCRMCallBundle has incorrect call view page visibility CVSS 3.1MEDIUM 5.0
Sources
- CVE-2021-39198 · CVE Program
- CVE-2021-39198 · NVD
- FIRST EPSS
- GHSA-vf7h-6246-hm43 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences