-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fat_free_crm | rubygems | < 0.12.1 | 0.12.1 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from the static assignment of FatFreeCRM::Application.config.secret_token in the initializer file. The pre-patch code explicitly sets this value to a fixed string ('51aa366864a80316a85cff0d3762347f4ae3d029d548bef034d56e82b1a2ffac5353ee6719d9b64e4354e2a0b1a901679f46a851c360a2ea377188e4b196b6b6'), violating CWE-330 by using a predictable/non-random value. The commit diff shows this line was guarded behind a test environment check post-patch, forcing runtime secret generation via rake ffcrm:secret in production. This static initialization is the root cause enabling cookie spoofing.
Ongoing coverage of React2Shell