Lucene search

MitreCVE-2009-3248

HistorySep 18, 2009 - 8:30 p.m.

CVE-2009-3248

2009-09-1820:30:00

CWE-352

mitre

web.nvd.nist.gov

cve

2009

3248

cross-site request forgery

csrf

vulnerability

vtiger crm

rss module

hijack

authentication

admin users

news feed system

rssurl parameter

index.php

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.1

Confidence

Low

EPSS

0.032

Percentile

91.2%

JSON

Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php.

Affected configurations

Nvd

Node

vtigervtiger_crmMatch5.0.4

VendorProductVersionCPE
vtigervtiger_crm5.0.4cpe:2.3:a:vtiger:vtiger_crm:5.0.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vtiger	vtiger_crm	5.0.4	cpe:2.3:a:vtiger:vtiger_crm:5.0.4:::::::*

References

marc.info/?l=bugtraq&m=125060676515670&w=2

secunia.com/advisories/36309

www.exploit-db.com/exploits/9450

www.osvdb.org/57238

www.securityfocus.com/bid/36062

www.ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities/

www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt

www.vupen.com/english/advisories/2009/2319

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.1

Confidence

Low

EPSS

0.032

Percentile

91.2%

JSON

Related for CVE-2009-3248