CVE-2006-4588
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module.
vtiger CRM 4.2.4, y posiblemente anteriores, permiten a un atacante remoto evitar la validación y acceder a modulos de administración a través de una pregunta directa a index.php con un parámetro modificado de modulo, como se demostró con el uso del módulo Settings.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2006-09-06 CVE Reserved
- 2006-09-06 CVE Published
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- 2024-12-26 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.osvdb.org/28462 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2006/3444 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| http://www.security-net.biz/adv/D3906a.txt | 2024-08-07 | |
| http://www.securityfocus.com/bid/19829 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/21728 | 2011-03-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vtiger Search vendor "Vtiger" | Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm" | 4.2 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.2" | - |
Affected
| ||||||
| Vtiger Search vendor "Vtiger" | Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm" | 4.2.4 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.2.4" | - |
Affected
| ||||||