Lucene search

MitreCVE-2007-6222

HistoryDec 04, 2007 - 5:46 p.m.

CVE-2007-6222

2007-12-0417:46:00

CWE-264

mitre

web.nvd.nist.gov

cve-2007-6222

checkcustomeraccess

functions.php

crm-ctt interleave

access restrictions

user privileges

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.4

Confidence

Low

EPSS

0.002

Percentile

65.5%

JSON

The CheckCustomerAccess function in functions.php in CRM-CTT Interleave before 4.2.0 (formerly CRM-CTT) does not properly verify user privileges, which allows remote authenticated users with the LIMITTOCUSTOMERS privilege to bypass intended access restrictions and edit non-active user settings. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

crm_cttinterleaveRange≤4.2.0

VendorProductVersionCPE
crm_cttinterleave*cpe:2.3:a:crm_ctt:interleave:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
crm_ctt	interleave	*	cpe:2.3:a:crm_ctt:interleave::::::::

References

secunia.com/advisories/27874

sourceforge.net/project/shownotes.php?release_id=558602&group_id=61096

www.securityfocus.com/bid/26685

exchange.xforce.ibmcloud.com/vulnerabilities/38808

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.4

Confidence

Low

EPSS

0.002

Percentile

65.5%

JSON

Related for CVE-2007-6222