CVE-2011-4679

Severity Score

4.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report.

vtiger CRM antes de v5.3.0 no reconoce adecuadamente el estado deshabilitado de un campo en el módulo Leads, lo que permite a usuarios autenticados remotamente evitar restricciones de acceso intencionadas leyendo un informe previamente creado.

*Credits: N/A

CVSS Scores

NISTv2 4.0

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-12-06 CVE Reserved
2011-12-07 CVE Published
2024-09-16 CVE Updated
2024-09-16 First Exploit
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7003	2024-09-16
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7004	2024-09-16

URL	Date	SRC

URL	Date	SRC
http://wiki.vtiger.com/index.php/Oct2011:ODUpdate	2017-11-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				< 5.3.0 Search vendor "Vtiger" for product "Vtiger Crm" and version " < 5.3.0"		-		Affected