Fat Free CRM vulnerable to Exposure of Sensitive Information
Date: 2022-05
Affected: rubygems/fat_free_crm
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2013-7249
CWE: CWE-200

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.xml`, a different vulnerability than CVE-2013-7224.


Mitigations:

Architectural layers (MAESTRO):