CVE Daily

CVE-2010-3909

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5...

Medium CVSS 6.0

Overview

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.

CWE: CWE-94 Published: 2010-11-26T20:00:03.877
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 6.0 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags