medium5.0
CVE-2008-3458
Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge temp…
Impact
Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vtiger | Vtiger Crm | through 5.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/28370
- http://sourceforge.net/project/shownotes.php?release_id=567189
- http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811
- http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107
- http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_Notes
- http://www.osvdb.org/40218
- http://www.securityfocus.com/bid/27228
- http://secunia.com/advisories/28370
- http://sourceforge.net/project/shownotes.php?release_id=567189
- http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811
- http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107
- http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_Notes
- http://www.osvdb.org/40218
- http://www.securityfocus.com/bid/27228