Remote Denial of Service via Tasks endpoint in fat_free_crm
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01783 78th percentileScored 2026-11-07
Fix Fixed fat_free_crm (fatfreecrm): 0.20.1fat_free_crm (RubyGems): 0.20.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fatfreecrm | fat_free_crm | before 0.20.1 | 0.20.1 | Patch available | CNA |
| — | fat_free_crm (RubyGems) | before 0.20.1 | 0.20.1 | Patch available | GHSA-p75c-5x3h-cxcg |
- fat_free_crm Vendorfatfreecrm Affected before 0.20.1 Fixed in 0.20.1 Patch available CNA
- fat_free_crm (RubyGems) Vendor— Affected before 0.20.1 Fixed in 0.20.1 Patch available GHSA-p75c-5x3h-cxcg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:* | before 0.20.1 | Vulnerable | fatfreecrm |
- cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:* Versions before 0.20.1 Vulnerable ·fatfreecrm
Remediation
- Fix · CNA fat_free_crm (fatfreecrm) Fixed in 0.20.1
- Fix · GHSA-p75c-5x3h-cxcg fat_free_crm (RubyGems) Fixed in 0.20.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39281
- 2026-10-03 Alias added: GHSA-p75c-5x3h-cxcg
References
Advisory 3
More Fatfreecrm vulnerabilities
- TI-2018-16064 FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-39281 · CVE Program
- CVE-2022-39281 · NVD
- FIRST EPSS
- GHSA-p75c-5x3h-cxcg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences