CVE-2010-3909 (GCVE-0-2010-3909)
Vulnerability from cvelistv5
Published
2010-11-26 19:00
Modified
2024-08-07 03:26
Severity ?
CWE
  • n/a
Summary
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
References
cve@mitre.orghttp://secunia.com/advisories/42246Vendor Advisory
cve@mitre.orghttp://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/
cve@mitre.orghttp://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
cve@mitre.orghttp://www.securityfocus.com/archive/1/514846/100/0/threaded
cve@mitre.orghttp://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42246Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/
af854a3a-2127-422b-91ae-364da2661108http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/514846/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:26:12.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/"
          },
          {
            "name": "42246",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42246"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes"
          },
          {
            "name": "20101116 Vtiger CRM 5.2.0 Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/514846/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-11-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/"
        },
        {
          "name": "42246",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42246"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes"
        },
        {
          "name": "20101116 Vtiger CRM 5.2.0 Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/514846/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3909",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt",
              "refsource": "MISC",
              "url": "http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt"
            },
            {
              "name": "http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/",
              "refsource": "MISC",
              "url": "http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/"
            },
            {
              "name": "42246",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/42246"
            },
            {
              "name": "http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes",
              "refsource": "MISC",
              "url": "http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes"
            },
            {
              "name": "20101116 Vtiger CRM 5.2.0 Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/514846/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3909",
    "datePublished": "2010-11-26T19:00:00",
    "dateReserved": "2010-10-12T00:00:00",
    "dateUpdated": "2024-08-07T03:26:12.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2010-3909\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2010-11-26T20:00:03.877\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de la lista negra incompleta en config.template.php en vtiger CRM antes de v5.2.1 permite a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario mediante la caracter\u00edstica de guardado de borrador en el componente Compose Mail para cargar un archivo con extensi\u00f3n .phtml, y luego acceder a este archivo a trav\u00e9s de una solicitud directa al archivo en el almacenamiento / \u00e1rbol de directorios.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:P/A:P\",\"baseScore\":6.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.8,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11DDE2EA-CD9C-456F-ADBF-BDBF13569065\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.2.0\",\"matchCriteriaId\":\"367F7FC6-7C3F-4CC3-8448-B9F8834CFDF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E55C900-AAB5-46A2-B650-ED3A9DE52C94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB4792CC-85E3-4317-A632-5A130E9C6F98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EAB300C8-ABE4-45BA-B260-570DD1E32F6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF0C897F-2066-43C3-AB44-EE66DB0C2B22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"458323BE-8583-435D-85B6-9F5F66F664A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D67FC276-11EB-4196-BDD9-84D69173EFAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:3.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A5C9AA-0C13-4DA4-845B-28CCE80D5A63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"288A4DD7-765B-4957-869F-98A836E4EF0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F5C4B4A-507F-4389-9094-96AE7D84DE93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6CDF5A9-E641-4FC3-8602-D47594524B20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"04C6B97E-408B-49B1-A1F3-C0D1107500D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23F2DEEE-E081-4ED2-AB1A-9ED966474CDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33644DF3-9777-405A-A106-1A6B4F1D6FB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8B3F151-0398-42C7-B194-FF528696D1E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4.2:*:validation:*:*:*:*:*\",\"matchCriteriaId\":\"661FD257-5B33-4DFE-AC59-AB48D1D12712\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:4.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"57840915-C75E-4D62-A017-E60DD1396D34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20038138-B797-40A5-A45B-9AB6C21033D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:5.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98DE0A56-EA74-4EA8-B941-F0DFF0F86F28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:5.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAF126B8-8BE9-4775-904B-5F6FD0FC97CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:5.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"84AE51A9-59AF-47F9-8AFC-5219505FD170\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:5.0.4:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"773AE04C-2478-412F-B961-147E2079B2D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:5.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7983E217-C378-4D29-AB23-0A1F6FF483B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vtiger:vtiger_crm:5.1.0:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"16C7FC4B-4253-45C5-92A4-26705A1D98FF\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/42246\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/514846/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/42246\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/514846/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorComment\":\"Per: http://cwe.mitre.org/data/definitions/184.html\\r\\n\\r\\n\u0027CWE-184: Incomplete Blacklist\u0027\"}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.