CVE-2023-3627 (published 2023-07-11T17:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/salesagility/suitecrm-core
commit_details: repo_url: https://github.com/salesagility/suitecrm-core
author: Jack Anderson
author_date: 2023-07-03 10:08:48+01:00
msg: SuiteCRM 8.3.1 Release
repository: repo_url: https://github.com/salesagility/suitecrm-core
repo_name: salesagility/SuiteCRM-Core
description: SuiteCRM - Open source CRM for the world
repo_language: PHP
owner: salesagility
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
   <img width="180px" height="41px" src="https://suitecrm.com/wp-content/uploads/2017/12/logo.png" align="right" />
 </a>
 
-# SuiteCRM 8.3.0
+# SuiteCRM 8.3.1
 
 [![LICENSE](https://img.shields.io/github/license/suitecrm/suitecrm.svg)](https://github.com/salesagility/suitecrm/blob/hotfix/LICENSE.txt)
 [![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/salesagility/SuiteCRM-Core/issues)

programming_language: Markdown
filename: VERSION
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-8.3.0
+8.3.1

programming_language: Batchfile
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "common",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "peerDependencies": {
     "@angular/common": "^12.1.0",
     "@angular/core": "^12.1.0",

programming_language: TypeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "core",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "peerDependencies": {
     "@angular/common": "^12.1.0",
     "@angular/core": "^12.1.0",

programming_language: TypeScript
filename: CSRFValidationListener.php
change_type: ModificationType.MODIFY
diff: @@ -84,7 +84,6 @@ class CSRFValidationListener
     {
         if (
             HttpKernelInterface::MASTER_REQUEST !== $event->getRequestType() ||
-            Request::METHOD_GET === $event->getRequest()->getMethod() ||
             Request::METHOD_HEAD === $event->getRequest()->getMethod() ||
             !$this->routeMatcher->match($event->getRequest(), $this->routes)
         ) {

programming_language: PHP
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "suitecrm",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "scripts": {
     "ng": "ng",
     "start": "npm run start:shell",

programming_language: TypeScript