CVE-2018-14398
An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake l…
Published: 2018-09-07 · CVSS: Unscored
An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake login page in order to steal credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7