NVD

Id
15244  
Name
CVE-2010-3909  
Description
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-11-26  
Modified Date
2010-11-29  
Seq
2010-3909  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
85919 15244 CVE-2010-3909 http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/  View
85920 15244 CVE-2010-3909 http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes  View
85921 15244 CVE-2010-3909 20101116 Vtiger CRM 5.2.0 Multiple Vulnerabilities  View
85922 15244 CVE-2010-3909 http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
37487 JVNDB-2010-003272 vtiger CRM の config.template.php における任意のコードを実行される脆弱性 vtiger CRM の config.template.php には、任意のコードを実行される脆弱性が存在します。 CVE-2010-3909 46489 CVE-2010-3909 15244 6 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-003272.html 2010-11-26 2012-03-27 View