PatchTheCVEzurmo crm vulnerabilities and fixes
Recent CVEs affecting zurmo crm, with upgrade or downgrade steps. 5 tracked.
Also searched as: zurmocrm.
zurmo crm has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2018-09-07. Highest priority: CVE-2017-7188 (score 42/100).
- CVE-2018-16654 MEDIUM 6.1 DOWNGRADE Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
- CVE-2017-7188 MEDIUM 5.4 UPGRADE Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a da
- CVE-2017-18004 MEDIUM 5.4 DOWNGRADE Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
- CVE-2017-16569 MEDIUM 4.8 DOWNGRADE An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to
- CVE-2017-15039 MEDIUM 4.8 DOWNGRADE Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to
FAQ
How do I fix zurmo crm vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zurmo crm being exploited right now?
None of the tracked zurmo crm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zurmo crm CVE should I patch first?
CVE-2017-7188 currently ranks highest (42/100): Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a da.