CVE-2022-39281: Fat free crm Denial of Service Vulnerability
MODERATECVE-2022-39281 is a MODERATE (CVSS 6.5) denial of service vulnerability (CWE-20: Improper Input Validation) affecting Fat free crm libraries in the RubyGems ecosystem. The issue involves fat free crm vulnerable to remote denial of service via tasks endpoint. Remediation is available by upgrading affected packages to version 0.20.1.
CVE-2022-39281 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2022-39281
To remediate this vulnerability, upgrade all affected Fat free crm dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade fat_free_crm to 0.20.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for fat_free_crmHow to Check if You Are Affected
To determine whether your application is affected by CVE-2022-39281, inspect your project dependencies for Fat free crm:
inspect dependencies for fat_free_crmAnalyze the terminal output to locate any version of Fat free crm in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.20.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Fat free crm, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-39281 Affected Fat free crm Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
fat_free_crm
|
RubyGems |
< 0.20.1
|
0.20.1
|
References
Frequently Asked Questions
What is CVE-2022-39281?
Which Fat free crm versions are affected?
What version fixes CVE-2022-39281?
Is fat_free_crm affected?
What is the CVSS score of CVE-2022-39281?
What CWE is associated with CVE-2022-39281?
How can I check RubyGems dependencies for CVE-2022-39281?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-p75c-5x3h-cxcg",
"modified" : "2022-10-07T21:19:01Z",
"published" : "2022-10-07T21:19:01Z",
"aliases" : [ "CVE-2022-39281" ],
"summary" : "Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint",
"details" : "### Impact\nAn authenticated user can perform a remote Denial of Service attack against Fat Free CRM.\n\nThis vulnerability has been assigned the CVE identifier: CVE-2022-39281\n\nAffected versions: All\nNot affected: None\nFixed versions: 0.20.1\n\nAll users running an affected release should either upgrade or apply the patch immediately.\n\n### Releases\nFixed versions: 0.20.1 and above\n\n### Patches\n\nIf you are unable to upgrade immediately, you should apply the following patch.\n\n```\ndiff --git a/app/models/polymorphic/task.rb b/app/models/polymorphic/task.rb\nindex d3d5c32c..7cdb24d6 100644\n--- a/app/models/polymorphic/task.rb\n+++ b/app/models/polymorphic/task.rb\n@@ -189,6 +189,7 @@ class Task < ActiveRecord::Base\n #----------------------------------------------------------------------------\n def self.bucket_empty?(bucket, user, view = \"pending\")\n return false if bucket.blank? || !ALLOWED_VIEWS.include?(view)\n+ return false unless Setting.task_bucket.map(&:to_s).include?(bucket.to_s)\n\n if view == \"assigned\"\n assigned_by(user).send(bucket).pending.count\n```\n\n### Credits\n\nThanks to @p- for reporting this and working with us to responsibly disclose this vulnerability.\n\n### Further information\nIf you have any questions or comments about this advisory, please Open an issue in [GitHub Issue Tracker](https://github.com/fatfreecrm/fat_free_crm/issues)\n\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "RubyGems",
"name" : "fat_free_crm"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.20.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-39281"
}, {
"type" : "WEB",
"url" : "https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/fatfreecrm/fat_free_crm"
}, {
"type" : "WEB",
"url" : "https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1"
}, {
"type" : "WEB",
"url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2022-39281.yml"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-20" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2022-10-07T21:19:01Z",
"nvd_published_at" : "2022-10-08T01:15:00Z"
}
}