high8.8
CVE-2019-19202
In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 …
Impact
In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vtiger | Vtiger Crm | from 7.0 before 7.2.0 |