GCVE - cpe:2.3:a:fatfreecrm:fat_free_crm:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:fatfreecrm:fat_free_crm:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Fatfreecrm (`e4026291-a850-599d-8453-4242f6e24704`)
Product	Fat Free Crm (`d943e906-2aac-563b-b35b-d41711d3c072`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/mateerladnam/fat-free-crm`	purl2cpe	2026-06-01 10:15:43.910130
`pkg:docker/udalov/fat-free-crm`	purl2cpe	2026-06-01 10:15:43.910133
`pkg:gem/fat-free-crm`	purl2cpe	2026-06-01 10:15:43.910136
`pkg:github/fatfreecrm/fat-free-crm`	purl2cpe	2026-06-01 10:15:43.910139
`pkg:github/fatfreecrm/fat_free_crm`	purl2cpe	2026-06-01 10:15:43.910142
`pkg:github/sergio-fry/fat-free-crm`	purl2cpe	2026-06-01 10:15:43.910144

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-39281`	vulnerable	2026-06-08 05:47:18.522564	Remote Denial of Service via Tasks endpoint in fat_free_crm MEDIUM (6.5) fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue. Published: 2022-10-08T00:00:00.000Z Updated: 2025-04-23T16:52:02.830Z Open on db.gcve.eu Reference links https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71 https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-20975`	vulnerable	2026-06-08 05:11:28.263416	Details available Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb. Published: 2019-08-20T12:14:26.000Z Updated: 2024-08-05T12:19:26.980Z Open on db.gcve.eu Reference links https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.18.1 https://github.com/fatfreecrm/fat_free_crm/commit/6d60bc8ed010c4eda05d6645c64849f415f68d65 https://github.com/fatfreecrm/fat_free_crm/compare/v0.17.3...v0.18.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1585`	vulnerable	2026-06-08 05:06:25.886239	Details available Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account. Published: 2015-02-19T15:00:00.000Z Updated: 2024-08-06T04:47:17.407Z Open on db.gcve.eu Reference links https://github.com/fatfreecrm/fat_free_crm/wiki/CSRF-Vulnerability-%28CVE-2015-1585%29 http://www.securityfocus.com/archive/1/534709/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/100925 http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5441`	vulnerable	2026-06-08 05:05:47.929001	Details available Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action. Published: 2014-09-12T14:00:00.000Z Updated: 2024-08-06T11:41:49.310Z Open on db.gcve.eu Reference links https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-vulnerability-%2826th-August-2014%29 http://packetstormsecurity.com/files/127978/Fatt-Free-CRM-Cross-Site-Scripting.html https://github.com/fatfreecrm/fat_free_crm/commit/95464495f1e3e714d5c295fe621af5d2e0d4238d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-7249`	vulnerable	2026-06-08 05:05:08.805606	Details available Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224. Published: 2014-01-02T11:00:00.000Z Updated: 2024-08-06T18:01:20.098Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2013/Dec/199 http://openwall.com/lists/oss-security/2013/12/28/2 http://www.phenoelit.org/stuff/ffcrm.txt https://github.com/fatfreecrm/fat_free_crm/commit/cf26a04b356ad2161c4c6160260eb870a3de5328 https://github.com/fatfreecrm/fat_free_crm/issues/300	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-7225`	vulnerable	2026-06-08 05:05:08.700950	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-7224`	vulnerable	2026-06-08 05:05:08.700379	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-7223`	vulnerable	2026-06-08 05:05:08.699805	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-7222`	vulnerable	2026-06-08 05:05:08.694792	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.