PatchTheCVEzurmo vulnerabilities
Recent CVEs affecting zurmo products. 7 tracked.
zurmo has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2019-08-01. Highest priority: CVE-2019-14472 (score 41/100).
- CVE-2019-14472 MEDIUM 6.1 DOWNGRADE Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
- CVE-2018-19596 MEDIUM 4.8 DOWNGRADE Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-201
- CVE-2018-19506 MEDIUM 4.8 DOWNGRADE Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/rep
- CVE-2018-16654 MEDIUM 6.1 DOWNGRADE Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
- CVE-2017-18004 MEDIUM 5.4 DOWNGRADE Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
- CVE-2017-16569 MEDIUM 4.8 DOWNGRADE An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to
- CVE-2017-15039 MEDIUM 4.8 DOWNGRADE Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to
FAQ
How do I fix zurmo vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zurmo being exploited right now?
None of the tracked zurmo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zurmo CVE should I patch first?
CVE-2019-14472 currently ranks highest (41/100): Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO..