CVE-2019-11457: Cross-Site Request Forgery in MicroPyramid Django CRM

September 11, 2019 (updated September 16, 2024)

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.

References

github.com/MicroPyramid/Django-CRM
github.com/advisories/GHSA-pg2f-r7pc-6fxx
github.com/pypa/advisory-database/tree/main/vulns/django-crm/PYSEC-2019-174.yaml
nvd.nist.gov/vuln/detail/CVE-2019-11457
www.netsparker.com/blog/web-security

Code Behaviors & Features

Detect and mitigate CVE-2019-11457 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →