CVE-2021-39198

5.4 mediumEPSS 0.3%

Medium (5.4) in oroinc client relationship management. EPSS 0.3% chance of exploitation in the next 30 days.

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2021-11-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oroinc:client_relationship_management

References

https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43
https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43

Check your stack JSON