Vulnerability in Vtiger Crm

CVE-2009-3257

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a profile by creating a Sales Order (SO) associated with that profile.

EPSS: 0.009 (54.9th percentile) — read the EPSS interpretation.

Affected products

Vtiger Vtiger_crm
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
cve@mitre.org (x_refsource_CONFIRM, Exploit, Vendor Advisory)