CVE-2008-3458

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory.
Configurations

Configuration 1 (hide)

cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*

History

21 Nov 2024, 00:49

Type Values Removed Values Added
References () http://secunia.com/advisories/28370 - Third Party Advisory () http://secunia.com/advisories/28370 - Third Party Advisory
References () http://sourceforge.net/project/shownotes.php?release_id=567189 - Broken Link () http://sourceforge.net/project/shownotes.php?release_id=567189 - Broken Link
References () http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811 - Exploit, Vendor Advisory () http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811 - Exploit, Vendor Advisory
References () http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107 - Vendor Advisory () http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107 - Vendor Advisory
References () http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_Notes - Vendor Advisory () http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_Notes - Vendor Advisory
References () http://www.osvdb.org/40218 - Broken Link () http://www.osvdb.org/40218 - Broken Link
References () http://www.securityfocus.com/bid/27228 - Patch, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/27228 - Patch, Third Party Advisory, VDB Entry

Information

Published : 2008-08-04 19:41

Updated : 2024-11-21 00:49


NVD link : CVE-2008-3458

Mitre link : CVE-2008-3458

CVE.ORG link : CVE-2008-3458


JSON object : View

Products Affected

vtiger

  • vtiger_crm
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor