PT-2007-4855 · Vtiger · Vtiger Crm

Published 2007-07-06 · Updated 2008-11-15 · CVE-2007-3600

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.0.3

Description The issue allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template. This is demonstrated by the fields in the Contact module, specifically through the WordPlugin in the wordintegration component.

Recommendations For versions prior to 5.0.3, update to version 5.0.3 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-3600

Affected Products

Vtiger Crm

References · 6

• http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/10845 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3600 · Security Note
• http://trac.vtiger.com/cgi-bin/trac.cgi/report/9 · Note
• http://osvdb.org/45784 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3600 · Note
• http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/3790 · Note