CVE-2014-2268
First published: Sun Nov 16 2014(Updated: )
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vtiger Vtiger Crm | =1.0 | |
| Vtiger Vtiger Crm | =2.0 | |
| Vtiger Vtiger Crm | =2.0.1 | |
| Vtiger Vtiger Crm | =2.1 | |
| Vtiger Vtiger Crm | =3.0 | |
| Vtiger Vtiger Crm | =3.0-beta | |
| Vtiger Vtiger Crm | =3.2 | |
| Vtiger Vtiger Crm | =4 | |
| Vtiger Vtiger Crm | =4-beta | |
| Vtiger Vtiger Crm | =4-rc1 | |
| Vtiger Vtiger Crm | =4.0 | |
| Vtiger Vtiger Crm | =4.0.1 | |
| Vtiger Vtiger Crm | =4.2 | |
| Vtiger Vtiger Crm | =4.2.4 | |
| Vtiger Vtiger Crm | =5.0.0 | |
| Vtiger Vtiger Crm | =5.0.1 | |
| Vtiger Vtiger Crm | =5.0.2 | |
| Vtiger Vtiger Crm | =5.0.3 | |
| Vtiger Vtiger Crm | =5.0.4 | |
| Vtiger Vtiger Crm | =5.0.4-rc | |
| Vtiger Vtiger Crm | =5.1.0 | |
| Vtiger Vtiger Crm | =5.1.0-rc | |
| Vtiger Vtiger Crm | =5.2.0 | |
| Vtiger Vtiger Crm | =5.2.1 | |
| Vtiger Vtiger Crm | =5.3.0 | |
| Vtiger Vtiger Crm | =5.4.0 | |
| Vtiger Vtiger Crm | =6.0.0 | |
| Vtiger Vtiger Crm | =6.0.0-beta | |
| Vtiger Vtiger Crm | =6.0.0-rc | |
| Vtiger Vtiger Crm | =6.0.0-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html
- http://www.exploit-db.com/exploits/32794
- http://www.securityfocus.com/bid/66757
- https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/vtiger
- canonical/vtiger vtiger crm
- version/vtiger vtiger crm/1.0
- version/vtiger vtiger crm/2.0
- version/vtiger vtiger crm/2.0.1
- version/vtiger vtiger crm/2.1
- version/vtiger vtiger crm/3.0
- version/vtiger vtiger crm/3.0-beta
- version/vtiger vtiger crm/3.2
- version/vtiger vtiger crm/4
- version/vtiger vtiger crm/4-beta
- version/vtiger vtiger crm/4-rc1
- version/vtiger vtiger crm/4.0
- version/vtiger vtiger crm/4.0.1
- version/vtiger vtiger crm/4.2
- version/vtiger vtiger crm/4.2.4
- version/vtiger vtiger crm/5.0.0
- version/vtiger vtiger crm/5.0.1
- version/vtiger vtiger crm/5.0.2
- version/vtiger vtiger crm/5.0.3
- version/vtiger vtiger crm/5.0.4
- version/vtiger vtiger crm/5.0.4-rc
- version/vtiger vtiger crm/5.1.0
- version/vtiger vtiger crm/5.1.0-rc
- version/vtiger vtiger crm/5.2.0
- version/vtiger vtiger crm/5.2.1
- version/vtiger vtiger crm/5.3.0
- version/vtiger vtiger crm/5.4.0
- version/vtiger vtiger crm/6.0.0
- version/vtiger vtiger crm/6.0.0-beta
- version/vtiger vtiger crm/6.0.0-rc
- version/vtiger vtiger crm/6.0.0-sp1