PT-2007-4857 · Mozilla+1 · Thunderbird+1

Jinxed · Published 2007-07-06 · Updated 2008-09-05 · CVE-2007-3602

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.0.3

Description The issue concerns the SOAP webservice in vtiger CRM, where it fails to verify if an authenticated account is active. This allows remote authenticated users with inactive accounts to access and modify data. An example of this exploit is demonstrated through the Thunderbird plugin.

Recommendations For versions prior to 5.0.3, update to version 5.0.3 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-3602

Affected Products

Thunderbird

Vtiger Crm

References · 6

• http://forums.vtiger.com/viewtopic.php?p=44233 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3602 · Security Note
• http://trac.vtiger.com/cgi-bin/trac.cgi/report/9 · Note
• http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/3084 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3602 · Note
• http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/10245 · Note