{"id":"GHSA-gmg5-r3c4-3fm9","summary":"Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability","details":"## Withdrawn\nThis advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references.\n\n[According to maintainers of Fat Free CRM](https://github.com/github/advisory-database/pull/3599), the CRM comment feature allows certain HTML markup, but santizes the output when rendered to page. This allows safe tags (such as `\u003ch1\u003e` which the author tested and reported as a vulnerability) but correctly disallows `\u003cscript\u003e` tags and other dangerous entities.\n\n## Original Description\nHTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.","aliases":["CVE-2019-10226"],"modified":"2026-09-10T03:49:22.809345035Z","published":"2022-05-24T16:47:42Z","withdrawn":"2024-02-23T18:00:56Z","database_specific":{"nvd_published_at":"2019-06-10T23:29:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-01-23T14:12:23Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10226"},{"type":"WEB","url":"https://github.com/fatfreecrm/fat_free_crm/issues/1235"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/3599"},{"type":"WEB","url":"https://apidock.com/rails/ActionView/Helpers/TextHelper/simple_format"},{"type":"PACKAGE","url":"https://github.com/fatfreecrm/fat_free_crm"},{"type":"WEB","url":"https://github.com/fatfreecrm/fat_free_crm/blob/master/app/views/comments/_comment.html.haml#L2"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2019-10226.yml"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/46617"},{"type":"WEB","url":"http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html"}],"affected":[{"package":{"name":"fat_free_crm","ecosystem":"RubyGems","purl":"pkg:gem/fat_free_crm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.19.0"}]}],"versions":["0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.1","0.12.2","0.12.3","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.14.0","0.14.1","0.14.2","0.15.0","0.15.0.beta","0.15.0.beta.2","0.15.1","0.15.2","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.1","0.17.2","0.17.3","0.18.0","0.18.1","0.18.2","0.19.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gmg5-r3c4-3fm9/GHSA-gmg5-r3c4-3fm9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}