PT-2008-4521 · Vtiger · Vtiger Crm
Fabian Fingerle
+1
·
Published
2008-09-03
·
Updated
2018-10-11
·
CVE-2008-3101
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
vtiger CRM version 5.0.4
Description:
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in different modules. The affected parameters include the
parenttab parameter in the Products module, the user password parameter in the Users module, and the query string parameter in the Home module, all of which are accessible through index.php.Recommendations:
For vtiger CRM version 5.0.4, consider disabling access to the vulnerable parameters
parenttab, user password, and query string in their respective modules until a patch is available. Restrict access to the Products, Users, and Home modules to minimize the risk of exploitation. Avoid using the parenttab, user password, and query string parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vtiger Crm