PT-2004-2518 · Sage · Saleslogix

Carl Livitt · Published 2004-10-18 · Updated 2016-10-18 · CVE-2004-1610

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SalesLogix version 6.1

Description The issue allows remote authenticated users to potentially create arbitrary files and execute code. This is achieved by using client-specified pathnames for writing certain files, specifically through the vMME.AttachmentPath or vMME.LibraryPath variables.

Recommendations For SalesLogix version 6.1, consider restricting access to the vMME.AttachmentPath and vMME.LibraryPath variables to minimize the risk of exploitation. Additionally, limit the ability of remote authenticated users to write files to specific directories. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-1610

Affected Products

Saleslogix

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2004-1610 · Security Note
• http://marc.info/?l=bugtraq&m=109811852218478&w=2 · Note