Unrestructed file upload in yetiforcecompany/yetiforcecrm
Priority LOW 29CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.
Summary
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
Why it matters now
EPSS 0.00761 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed yetiforcecompany/yetiforcecrm (yetiforcecompany): 6.4.0yetiforce/yetiforce-crm (Packagist): 6.4.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| yetiforcecompany | yetiforcecompany/yetiforcecrm | before 6.4.0 | 6.4.0 | Patch available | CNA |
| — | yetiforce/yetiforce-crm (Packagist) | before 6.4.0 | 6.4.0 | Patch available | GHSA-pqr6-3j58-9w58 |
- yetiforcecompany/yetiforcecrm Vendoryetiforcecompany Affected before 6.4.0 Fixed in 6.4.0 Patch available CNA
- yetiforce/yetiforce-crm (Packagist) Vendor— Affected before 6.4.0 Fixed in 6.4.0 Patch available GHSA-pqr6-3j58-9w58
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yetiforce:yetiforce_customer_relationship_management:*:*:*:*:*:*:*:* | before 6.4.0 | Vulnerable | yetiforcecompany |
- cpe:2.3:a:yetiforce:yetiforce_customer_relationship_management:*:*:*:*:*:*:*:* Versions before 6.4.0 Vulnerable ·yetiforcecompany
Remediation
- Fix · CNA yetiforcecompany/yetiforcecrm (yetiforcecompany) Fixed in 6.4.0
- Fix · GHSA-pqr6-3j58-9w58 yetiforce/yetiforce-crm (Packagist) Fixed in 6.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1411
- 2026-10-03 Alias added: GHSA-pqr6-3j58-9w58
References
More yetiforcecompany Yetiforce Customer Relationship Management vulnerabilities
- TI-2022-02773 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm CVSS 3.1MEDIUM 5.4
- TI-2022-02772 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm CVSS 3.1MEDIUM 5.4
- TI-2022-02769 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm CVSS 3.1MEDIUM 5.4
- TI-2022-02704 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm CVSS 3.1MEDIUM 5.4
- TI-2022-00203 Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm CVSS 3.1HIGH 8.0
- TI-2023-27042 Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-1411 · CVE Program
- CVE-2022-1411 · NVD
- FIRST EPSS
- GHSA-pqr6-3j58-9w58 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences