CVE Vulnerability

CVE-2008-3458

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

References
Link Resource
http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811 Exploit Vendor Advisory
http://sourceforge.net/project/shownotes.php?release_id=567189 Broken Link
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107 Vendor Advisory
http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_Notes Vendor Advisory
http://www.securityfocus.com/bid/27228 Patch Third Party Advisory
http://www.osvdb.org/40218 Broken Link
http://secunia.com/advisories/28370 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*
Information

Published : 2008-08-04 07:41

Updated : 2017-11-22 05:25

NVD link : CVE-2008-3458

Mitre link : CVE-2008-3458

Products Affected
No products.
CWE
CWE-200