PT-2005-4571 · Vtiger · Vtiger Crm

Christopher Kunz + 1 · Publicado 2005-11-26 · Atualizado 2018-10-19 · CVE-2005-3823

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 4.2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval() function.

Recommendations For versions 4.2 and earlier, consider restricting access to the Users module until a fix is available. As a temporary workaround, avoid using the templatename parameter in the affected module to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3823

Produtos afetados

Vtiger Crm

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3823 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3823 · Nota de Segurança
• http://securityfocus.com/bid/15569 · Nota
• http://marc.info/?l=full-disclosure&m=113290708121951&w=2 · Nota
• http://vupen.com/english/advisories/2005/2569 · Nota
• http://securityfocus.com/archive/1/417711/30/0/threaded · Nota
• http://secunia.com/advisories/17693 · Aviso do Fabricante
• http://securitytracker.com/id?1015274 · Nota