CVE-2008-3101: XSS
First published: Wed Sep 03 2008(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an Authenticate action to the Users module, as reachable through index.php; or (3) the query_string parameter in a UnifiedSearch action to the Home module, as reachable through index.php.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vtiger Vtiger Crm | =5.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.datensalat.eu/~fabian/cve/CVE-2008-3101-vtigerCRM.html
- http://www.securityfocus.com/bid/30951
- http://secunia.com/advisories/31679
- http://securityreason.com/securityalert/4208
- http://www.vupen.com/english/advisories/2008/2471
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44792
- http://www.vtiger.de/vtiger-crm/downloads/patches.html?tx_abdownloads_pi1[action]=getviewdetailsfordownload&tx_abdownloads_pi1[uid]=128&tx_abdownloads_pi1[category_uid]=5&cHash=e16be773a5
- http://www.securityfocus.com/archive/1/495885/100/0/threaded
- http://www.vtiger.de/vtiger-crm/downloads/patches.html?tx_abdownloads_pi1%5Baction%5D=getviewdetailsfordownload&tx_abdownloads_pi1%5Buid%5D=128&tx_abdownloads_pi1%5Bcategory_uid%5D=5&cHash=e16be773a5
- collector/nvd-historical
- collector/nvd-index
- collector/nvd-api
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/vtiger
- canonical/vtiger vtiger crm
- version/vtiger vtiger crm/5.0.4