PT-2024-31247 · Unknown · Vtiger Crm

Published 2024-08-29 · Updated 2025-03-11 · CVE-2024-44779

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vTiger CRM version 7.4.0

Description A reflected cross-site scripting (XSS) issue in the viewname parameter of the index page allows attackers to execute arbitrary code in the context of a user's browser by injecting a specially crafted payload. The viewname parameter is vulnerable to this issue, enabling attackers to run code in the user's browser context.

Recommendations For vTiger CRM version 7.4.0, consider disabling access to the index page or restricting the use of the viewname parameter until a patch is available. Avoid using the viewname parameter in the affected index page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-44779

Affected Products

Vtiger Crm

References · 8

• https://osv.dev/vulnerability/CVE-2024-44779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44779 · Security Note
• http://vtiger.com · Note
• https://twitter.com/CVEnew/status/1829222500519292978 · Twitter Post
• https://twitter.com/Xaliom/status/1829939141871567205 · Twitter Post
• https://t.me/cvedetector/4436 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1899589947625025628 · Twitter Post
• https://packetstormsecurity.com/files/180462/vTiger-CRM-7.4.0-Cross-Site-Scripting.html · Note