NVD

Id
55748  
Name
CVE-2007-3598  
Description
index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users" names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that the attack vector results in a "You are not permitted to execute this Operation" error message in a 5.0.3 demo.  
Reject
 
CVSS Version
2  
CVSS Score
5.5  
Severity
Medium  
CVSS Base Score
5.5  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-07  
Published
2007-07-06  
Modified Date
2008-09-05  
Seq
2007-3598  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
283451 55748 CVE-2007-3598 http://forums.vtiger.com/viewtopic.php?p=38609  View
283452 55748 CVE-2007-3598 http://trac.vtiger.com/cgi-bin/trac.cgi/report/9  View
283453 55748 CVE-2007-3598 http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2664  View
283454 55748 CVE-2007-3598 http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2985  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
57125 JVNDB-2007-005817 index.php の vtiger CRM における全ユーザ名などを取得される脆弱性 index.php の vtiger CRM には、全ユーザ名および電子メールアドレスを取得される、およびユーザ設定を変更される脆弱性が存在します。 CVE-2007-3598 26953 CVE-2007-3598 55748 5.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-005817.html 2007-02-05 2012-12-20 View