CVE-2021-4117

Description

YetiForceCRM is vulnerable to Business Logic Errors in the Weight of a Product since that value can be a negative number.

How to fix CVE-2021-4117

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Packagist/yetiforce/yetiforce-crm—no fix listed

Is CVE-2021-4117 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 6.3.0

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-4117
• PATCHgithub.com/yetiforcecompany/yetiforcecrm
• WEBgithub.com/yetiforcecompany/yetiforcecrm/commit/8dccd93442725f245b4b71986bbe6f4f48639239
• WEBhuntr.dev/bounties/0b81e572-bdc9-4caf-aa02-81f3c7ad7c0a