zurmo vulnerabilities and fixes

Recent CVEs affecting zurmo, with upgrade or downgrade steps. 3 tracked.

zurmo has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2019-08-01. Highest priority: CVE-2019-14472 (score 41/100).

• CVE-2019-14472 MEDIUM 6.1 DOWNGRADE Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
• CVE-2018-19596 MEDIUM 4.8 DOWNGRADE Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-201
• CVE-2018-19506 MEDIUM 4.8 DOWNGRADE Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/rep

FAQ

How do I fix zurmo vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is zurmo being exploited right now?

None of the tracked zurmo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which zurmo CVE should I patch first?

CVE-2019-14472 currently ranks highest (41/100): Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO..

RSS feed for zurmo · ← Back to latest CVEs