CVE-2022-1411: Unrestructed file upload in yetiforcecompany/yetiforcecrm

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-05 · updated 2026-06-17
Weakness: CWE-434

Description

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.

Affected products

Yetiforce Customer Relationship Management: before 6.4.0 — fixed in 6.4.0

How to fix

Upgrade to a fixed version: Yetiforce Customer Relationship Management 6.4.0. Check the vendor advisory for mitigations.

References

https://github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124
https://huntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529
https://github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124
https://huntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529

Get alerted when CVE-2022-1411 or the next vulnerability affects your stack