CVE-2020-15958

Published: Sep 18, 2020Modified: Jun 17, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

An issue was discovered in 1CRM System through 8.6.7. An insecure direct object reference to internally stored files allows a remote attacker to access various sensitive information via an unauthenticated request with a predictable URL.

Affected (1)

Products: 1crm: 1crm

1crm

1 product

1crm

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
1crm 1crm	Up to 8.6.7

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (8)

http://packetstormsecurity.com/files/159193/1CRM-8.6.7-Insecure-Direct-Object-Reference.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2020/Sep/31

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://1crm.com/documentation/

Source: cve@mitre.org

Product

https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-1crm-schutzt-daten-unzureichend-cve-2020-15958

Source: cve@mitre.org

Third Party Advisory

http://packetstormsecurity.com/files/159193/1CRM-8.6.7-Insecure-Direct-Object-Reference.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2020/Sep/31

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://1crm.com/documentation/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-1crm-schutzt-daten-unzureichend-cve-2020-15958

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.