CVE-2007-3602

Published: Jul 6, 2007Modified: Apr 23, 2026

5.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability: 8.0 / Impact: 4.9

Source: NVD

Description

The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin.

Affected (1)

Products: Vtiger: Vtiger Crm

Vtiger

1 product

Vtiger Crm

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vtiger Vtiger Crm	Up to 5.0.2

References (8)

http://forums.vtiger.com/viewtopic.php?p=44233

Source: cve@mitre.org

Patch

http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/10245

Source: cve@mitre.org

http://trac.vtiger.com/cgi-bin/trac.cgi/report/9

Source: cve@mitre.org

http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/3084

Source: cve@mitre.org

http://forums.vtiger.com/viewtopic.php?p=44233

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/10245

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.vtiger.com/cgi-bin/trac.cgi/report/9

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/3084

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.