CVEvulnerability
CVE-2009-3257
3.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2009-09-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.6 LOW — AV:N/AC:H/Au:S/C:N/I:P/A:P
- Weaknesses
- CWE-264
Description
vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a profile by creating a Sales Order (SO) associated with that profile.
Affected configurations
• vtiger vtiger crm (< 5.1.0)
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/36309 Third Party Advisory
- http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5055 Exploit, Vendor Advisory
- http://secunia.com/advisories/36309 Third Party Advisory
- http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5055 Exploit, Vendor Advisory