PT-2008-4521 · Vtiger · Vtiger Crm
Fabian Fingerle
+1
·
Publicado
2008-09-03
·
Atualizado
2018-10-11
·
CVE-2008-3101
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
vtiger CRM version 5.0.4
Description:
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in different modules. The affected parameters include the
parenttab parameter in the Products module, the user password parameter in the Users module, and the query string parameter in the Home module, all of which are accessible through index.php.Recommendations:
For vtiger CRM version 5.0.4, consider disabling access to the vulnerable parameters
parenttab, user password, and query string in their respective modules until a patch is available. Restrict access to the Products, Users, and Home modules to minimize the risk of exploitation. Avoid using the parenttab, user password, and query string parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Vtiger Crm