CVE-2008-3458

Published: Aug 4, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory.

Affected (1)

Products: Vtiger: Vtiger Crm

Vtiger

1 product

Vtiger Crm

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vtiger Vtiger Crm	Up to 5.0.3

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (14)

http://secunia.com/advisories/28370

Source: cve@mitre.org

Third Party Advisory

http://sourceforge.net/project/shownotes.php?release_id=567189

Source: cve@mitre.org

Broken Link

http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811

Source: cve@mitre.org

ExploitVendor Advisory

http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107

Source: cve@mitre.org

Vendor Advisory

http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_Notes

Source: cve@mitre.org

Vendor Advisory

http://www.osvdb.org/40218

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/bid/27228

Source: cve@mitre.org

PatchThird Party AdvisoryVDB Entry

http://secunia.com/advisories/28370