CVE-2009-3257

EUVD-2009-3240
vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a profile by creating a Sales Order (SO) associated with that profile.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.6 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:S/C:N/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
vtigervtiger_crm
𝑥
< 5.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/36309
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5055
http://secunia.com/advisories/36309
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5055