CVE-2008-3101
Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the…
Does this matter?
Lower severity and a low EPSS score (3.77%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an Authenticate action to the Users module, as reachable through index.php; or (3) the query_string parameter in a UnifiedSearch action to the Home module, as reachable through index.php.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 3.77% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- vtiger/vtiger crm
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/31679Patch, Vendor Advisory
- http://securityreason.com/securityalert/4208
- http://www.datensalat.eu/~fabian/cve/CVE-2008-3101-vtigerCRM.htmlExploit
- http://www.securityfocus.com/archive/1/495885/100/0/threaded
- http://www.securityfocus.com/bid/30951Exploit, Patch
- http://www.vtiger.de/vtiger-crm/downloads/patches.html?tx_abdownloads_pi1%5Baction%5D=getviewdetailsfordownload&tx_abdownloads_pi1%5Buid%5D=128&tx_abdownloads_pi1%5Bcategory_uid%5D=5&cHash=e16be773a5
- http://www.vupen.com/english/advisories/2008/2471
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44792
- http://secunia.com/advisories/31679Patch, Vendor Advisory
- http://securityreason.com/securityalert/4208
- http://www.datensalat.eu/~fabian/cve/CVE-2008-3101-vtigerCRM.htmlExploit
- http://www.securityfocus.com/archive/1/495885/100/0/threaded
- http://www.securityfocus.com/bid/30951Exploit, Patch
- http://www.vtiger.de/vtiger-crm/downloads/patches.html?tx_abdownloads_pi1%5Baction%5D=getviewdetailsfordownload&tx_abdownloads_pi1%5Buid%5D=128&tx_abdownloads_pi1%5Bcategory_uid%5D=5&cHash=e16be773a5
- http://www.vupen.com/english/advisories/2008/2471
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44792
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.