Lucene search

[email protected]CVE-2010-3909

HistoryNov 26, 2010 - 8:00 p.m.

CVE-2010-3909

2010-11-2620:00:03

CWE-94

[email protected]

web.nvd.nist.gov

vulnerability

config.template.php

vtiger crm

remote code execution

authenticated users

nvd

cve-2010-3909

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

7.5 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.4%

JSON

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.

Affected configurations

NVD

Node

vtigervtiger_crm

vtigervtiger_crmRange≤5.2.0

vtigervtiger_crmMatch1.0

vtigervtiger_crmMatch2.0

vtigervtiger_crmMatch2.0.1

vtigervtiger_crmMatch2.1

vtigervtiger_crmMatch3

vtigervtiger_crmMatch3.0

vtigervtiger_crmMatch3.0beta

vtigervtiger_crmMatch3.2

vtigervtiger_crmMatch4

vtigervtiger_crmMatch4beta

vtigervtiger_crmMatch4rc1

vtigervtiger_crmMatch4.0

vtigervtiger_crmMatch4.0.1

vtigervtiger_crmMatch4.2

vtigervtiger_crmMatch4.2validation

vtigervtiger_crmMatch4.2.4

vtigervtiger_crmMatch5.0.0

vtigervtiger_crmMatch5.0.2

vtigervtiger_crmMatch5.0.3

vtigervtiger_crmMatch5.0.4

vtigervtiger_crmMatch5.0.4rc

vtigervtiger_crmMatch5.1.0

vtigervtiger_crmMatch5.1.0rc

CPENameOperatorVersion
vtiger:vtiger_crmvtiger vtiger crmeq*
vtiger:vtiger_crmvtiger vtiger crmle5.2.0
vtiger:vtiger_crmvtiger vtiger crmeq1.0
vtiger:vtiger_crmvtiger vtiger crmeq2.0
vtiger:vtiger_crmvtiger vtiger crmeq2.0.1
vtiger:vtiger_crmvtiger vtiger crmeq2.1
vtiger:vtiger_crmvtiger vtiger crmeq3
vtiger:vtiger_crmvtiger vtiger crmeq3.0
vtiger:vtiger_crmvtiger vtiger crmeq3.2
vtiger:vtiger_crmvtiger vtiger crmeq4

CPE	Name	Operator	Version
vtiger:vtiger_crm	vtiger vtiger crm	eq	*
vtiger:vtiger_crm	vtiger vtiger crm	le	5.2.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	1.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	2.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	2.0.1
vtiger:vtiger_crm	vtiger vtiger crm	eq	2.1
vtiger:vtiger_crm	vtiger vtiger crm	eq	3
vtiger:vtiger_crm	vtiger vtiger crm	eq	3.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	3.2
vtiger:vtiger_crm	vtiger vtiger crm	eq	4