PatchTheCVEcrm vulnerabilities and fixes
Recent CVEs affecting crm, with upgrade or downgrade steps. 3 tracked.
crm has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2019-09-16. Highest priority: CVE-2017-5965 (score 45/100).
- CVE-2019-15950 MEDIUM 6.1 UPGRADE The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data.
- CVE-2017-5966 MEDIUM 4.9 DOWNGRADE Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute
- CVE-2017-5965 MEDIUM 6.7 DOWNGRADE The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbit
FAQ
How do I fix crm vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is crm being exploited right now?
None of the tracked crm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which crm CVE should I patch first?
CVE-2017-5965 currently ranks highest (45/100): The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbit.