var-201112-0339
Vulnerability from variot
vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report. Vtiger CRM is a Web-based Sales Capability Automation (SFA)-based Customer Relationship Management System (CRM). A vulnerability exists in versions prior to vtiger CRM 5.3.0 that stems from the inability to correctly identify the status of a defective field in the Leads module. vtiger CRM is prone to a security-bypass vulnerability. Attackers may exploit the issue to bypass certain unspecified security restrictions and gain unauthorized access. Versions prior to vtiger CRM 5.3.0 are vulnerable. The management system provides functions such as management, collection, and analysis of customer information
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201112-0339", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "crm", "scope": "lt", "trust": 1.8, "vendor": "vtiger", "version": "5.3.0" }, { "model": "crm", "scope": "eq", "trust": 0.9, "vendor": "vtiger", "version": "5.2.1" }, { "model": "crm", "scope": "eq", "trust": 0.9, "vendor": "vtiger", "version": "5.0.4" }, { "model": "crm", "scope": "eq", "trust": 0.9, "vendor": "vtiger", "version": "5.0.3" }, { "model": "crm", "scope": "lte", "trust": 0.6, "vendor": "vtiger", "version": "\u003c=5.2.x" }, { "model": "crm", "scope": "eq", "trust": 0.6, "vendor": "vtiger", "version": "5.1.0" }, { "model": "crm", "scope": "eq", "trust": 0.6, "vendor": "vtiger", "version": "5.0.0" }, { "model": "crm", "scope": "eq", "trust": 0.6, "vendor": "vtiger", "version": "5.2.0" }, { "model": "crm", "scope": "eq", "trust": 0.6, "vendor": "vtiger", "version": "5.0.2" }, { "model": "crm", "scope": "eq", "trust": 0.6, "vendor": "vtiger", "version": "1.0" }, { "model": null, "scope": "eq", "trust": 0.4, "vendor": "vtiger crm", "version": "*" }, { "model": "crm", "scope": "eq", "trust": 0.3, "vendor": "vtiger", "version": "5.2" }, { "model": "crm", "scope": "eq", "trust": 0.3, "vendor": "vtiger", "version": "4.2.4" }, { "model": "crm", "scope": "eq", "trust": 0.3, "vendor": "vtiger", "version": "4.2" }, { "model": "crm rc", "scope": "eq", "trust": 0.3, "vendor": "vtiger", "version": "5.0.4" }, { "model": "crm", "scope": "ne", "trust": 0.3, "vendor": "vtiger", "version": "5.3" } ], "sources": [ { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "BID", "id": "51024" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "CNNVD", "id": "CNNVD-201112-080" }, { "db": "NVD", "id": "CVE-2011-4679" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:vtiger:vtiger_crm", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2011-003299" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "pratim", "sources": [ { "db": "BID", "id": "51024" } ], "trust": 0.3 }, "cve": "CVE-2011-4679", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "CVE-2011-4679", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 1.8, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "CNVD", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "CNVD-2011-5717", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "IVD", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "7d716c21-463f-11e9-be3d-000c29342cb1", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.2, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.9 [IVD]" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "IVD", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "57ca12f8-2354-11e6-abef-000c29c66e3d", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.2, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.9 [IVD]" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "VHN-52624", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:S/C:N/I:P/A:N", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2011-4679", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2011-4679", "trust": 0.8, "value": "Medium" }, { "author": "CNVD", "id": "CNVD-2011-5717", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201112-080", "trust": 0.6, "value": "MEDIUM" }, { "author": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1", "trust": 0.2, "value": "MEDIUM" }, { "author": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d", "trust": 0.2, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-52624", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "VULHUB", "id": "VHN-52624" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "CNNVD", "id": "CNNVD-201112-080" }, { "db": "NVD", "id": "CVE-2011-4679" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report. Vtiger CRM is a Web-based Sales Capability Automation (SFA)-based Customer Relationship Management System (CRM). A vulnerability exists in versions prior to vtiger CRM 5.3.0 that stems from the inability to correctly identify the status of a defective field in the Leads module. vtiger CRM is prone to a security-bypass vulnerability. \nAttackers may exploit the issue to bypass certain unspecified security restrictions and gain unauthorized access. \nVersions prior to vtiger CRM 5.3.0 are vulnerable. The management system provides functions such as management, collection, and analysis of customer information", "sources": [ { "db": "NVD", "id": "CVE-2011-4679" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "BID", "id": "51024" }, { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "VULHUB", "id": "VHN-52624" } ], "trust": 2.88 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2011-4679", "trust": 3.8 }, { "db": "CNNVD", "id": "CNNVD-201112-080", "trust": 1.1 }, { "db": "CNVD", "id": "CNVD-2011-5717", "trust": 1.0 }, { "db": "JVNDB", "id": "JVNDB-2011-003299", "trust": 0.8 }, { "db": "BID", "id": "51024", "trust": 0.4 }, { "db": "IVD", "id": "7D716C21-463F-11E9-BE3D-000C29342CB1", "trust": 0.2 }, { "db": "IVD", "id": "57CA12F8-2354-11E6-ABEF-000C29C66E3D", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-52624", "trust": 0.1 } ], "sources": [ { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "VULHUB", "id": "VHN-52624" }, { "db": "BID", "id": "51024" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "CNNVD", "id": "CNNVD-201112-080" }, { "db": "NVD", "id": "CVE-2011-4679" } ] }, "id": "VAR-201112-0339", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "VULHUB", "id": "VHN-52624" } ], "trust": 1.6291666400000002 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS" ], "sub_category": null, "trust": 1.0 } ], "sources": [ { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "CNVD", "id": "CNVD-2011-5717" } ] }, "last_update_date": "2024-11-23T23:10:03.387000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Ticket #7003", "trust": 0.8, "url": "http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7003" }, { "title": "Ticket #7004", "trust": 0.8, "url": "http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7004" }, { "title": "Oct2011:ODUpdate", "trust": 0.8, "url": "http://wiki.vtiger.com/index.php/Oct2011:ODUpdate" }, { "title": "Patch for vtiger CRM Leads module security vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/37813" }, { "title": "vtigercrm-521-530-patch", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=41995" }, { "title": "vtigercrm-5.3.0", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=41994" }, { "title": "vtigercrm-5.3.0", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=41993" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "CNNVD", "id": "CNNVD-201112-080" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-264", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-52624" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "NVD", "id": "CVE-2011-4679" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.0, "url": "http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7003" }, { "trust": 2.0, "url": "http://wiki.vtiger.com/index.php/oct2011:odupdate" }, { "trust": 1.7, "url": "http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7004" }, { "trust": 1.4, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4679" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4679" }, { "trust": 0.3, "url": "http://www.vtiger.com/" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "VULHUB", "id": "VHN-52624" }, { "db": "BID", "id": "51024" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "CNNVD", "id": "CNNVD-201112-080" }, { "db": "NVD", "id": "CVE-2011-4679" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "VULHUB", "id": "VHN-52624" }, { "db": "BID", "id": "51024" }, { "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "db": "CNNVD", "id": "CNNVD-201112-080" }, { "db": "NVD", "id": "CVE-2011-4679" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2011-12-08T00:00:00", "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "date": "2011-12-08T00:00:00", "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "date": "2011-12-08T00:00:00", "db": "CNVD", "id": "CNVD-2011-5717" }, { "date": "2011-12-07T00:00:00", "db": "VULHUB", "id": "VHN-52624" }, { "date": "2011-01-04T00:00:00", "db": "BID", "id": "51024" }, { "date": "2011-12-12T00:00:00", "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "date": "2011-12-08T00:00:00", "db": "CNNVD", "id": "CNNVD-201112-080" }, { "date": "2011-12-07T19:55:02.440000", "db": "NVD", "id": "CVE-2011-4679" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2011-12-08T00:00:00", "db": "CNVD", "id": "CNVD-2011-5717" }, { "date": "2017-11-22T00:00:00", "db": "VULHUB", "id": "VHN-52624" }, { "date": "2011-01-04T00:00:00", "db": "BID", "id": "51024" }, { "date": "2011-12-12T00:00:00", "db": "JVNDB", "id": "JVNDB-2011-003299" }, { "date": "2011-12-08T00:00:00", "db": "CNNVD", "id": "CNNVD-201112-080" }, { "date": "2024-11-21T01:32:45.627000", "db": "NVD", "id": "CVE-2011-4679" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201112-080" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "vtiger CRM Leads Module Security Vulnerability", "sources": [ { "db": "IVD", "id": "7d716c21-463f-11e9-be3d-000c29342cb1" }, { "db": "IVD", "id": "57ca12f8-2354-11e6-abef-000c29c66e3d" }, { "db": "CNVD", "id": "CNVD-2011-5717" }, { "db": "CNNVD", "id": "CNNVD-201112-080" } ], "trust": 1.6 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control", "sources": [ { "db": "CNNVD", "id": "CNNVD-201112-080" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.