CVE-2023-3627: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-07-11T17:15Z
Repository: https://github.com/salesagility/suitecrm-core
Language: JSON
Files changed: README.md, VERSION, core/app/common/package.json, core/app/core/package.json, core/backend/Security/CSRFValidationListener.php, package.json
Commit date: 2023-07-03 10:27:18 +0100
Commit message: SuiteCRM 8.3.1 Release

Diff: diff --git a/README.md b/README.md
index 5aad4bf45..2ecc76188 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,10 @@
 <a href="https://suitecrm.com">
   <img width="180px" height="41px" src="https://suitecrm.com/wp-content/uploads/2017/12/logo.png" align="right" />
 </a>
 
-# SuiteCRM 8.3.0
+# SuiteCRM 8.3.1
 
 [![LICENSE](https://img.shields.io/github/license/suitecrm/suitecrm.svg)](https://github.com/salesagility/suitecrm/blob/hotfix/LICENSE.txt)
 [![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/salesagility/SuiteCRM-Core/issues)
 [![Gitter chat](https://badges.gitter.im/gitterHQ/gitter.png)](https://gitter.im/suitecrm/Lobby)
 [![Twitter](https://img.shields.io/twitter/follow/suitecrm.svg?style=social&label=Follow)](https://twitter.com/intent/follow?screen_name=suitecrm)
diff --git a/VERSION b/VERSION
index 2bf50aaf1..56b6be4eb 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.3.0
+8.3.1
diff --git a/core/app/common/package.json b/core/app/common/package.json
index 3e441a1dd..8a85995fc 100644
--- a/core/app/common/package.json
+++ b/core/app/common/package.json
@@ -1,8 +1,8 @@
 {
   "name": "common",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "peerDependencies": {
     "@angular/common": "^12.1.0",
     "@angular/core": "^12.1.0",
     "@angular/forms": "^12.1.0",
     "rxjs": "^6.6.3",
diff --git a/core/app/core/package.json b/core/app/core/package.json
index 859d3f04f..e2502546d 100644
--- a/core/app/core/package.json
+++ b/core/app/core/package.json
@@ -1,8 +1,8 @@
 {
   "name": "core",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "peerDependencies": {
     "@angular/common": "^12.1.0",
     "@angular/core": "^12.1.0",
     "rxjs": "^6.6.3",
     "apollo-angular": "^2.2.0",
diff --git a/core/backend/Security/CSRFValidationListener.php b/core/backend/Security/CSRFValidationListener.php
index feef356e6..d9a85cc87 100644
--- a/core/backend/Security/CSRFValidationListener.php
+++ b/core/backend/Security/CSRFValidationListener.php
@@ -82,11 +82,10 @@ class CSRFValidationListener
      */
     public function onKernelRequest(RequestEvent $event): void
     {
         if (
             HttpKernelInterface::MASTER_REQUEST !== $event->getRequestType() ||
-            Request::METHOD_GET === $event->getRequest()->getMethod() ||
             Request::METHOD_HEAD === $event->getRequest()->getMethod() ||
             !$this->routeMatcher->match($event->getRequest(), $this->routes)
         ) {
             return;
         }
diff --git a/package.json b/package.json
index 36faf809a..f997f490c 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "suitecrm",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "scripts": {
     "ng": "ng",
     "start": "npm run start:shell",
     "start:shell": "ng serve shell  -o --port 5000",
     "start:all": "concurrently \"npm run start:shell\"",

Vulnerable code: # SuiteCRM 8.3.0
8.3.0
  "version": "8.3.0",
  "version": "8.3.0",
            Request::METHOD_GET === $event->getRequest()->getMethod() ||
  "version": "8.3.0",
Fixed code: # SuiteCRM 8.3.1
8.3.1
  "version": "8.3.1",
  "version": "8.3.1",
  "version": "8.3.1",