CVE-2008-3458

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/28370Third Party Advisory
http://sourceforge.net/project/shownotes.php?release_id=567189Broken Link
http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811Exploit, Vendor Advisory
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107Vendor Advisory
http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_NotesVendor Advisory
http://www.osvdb.org/40218Broken Link
http://www.securityfocus.com/bid/27228Patch, Third Party Advisory, VDB Entry
http://secunia.com/advisories/28370Third Party Advisory
http://sourceforge.net/project/shownotes.php?release_id=567189Broken Link
http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811Exploit, Vendor Advisory
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2107Vendor Advisory
http://wiki.vtiger.com/index.php/Vtiger_CRM_5.0.4_-_Release_NotesVendor Advisory
http://www.osvdb.org/40218Broken Link
http://www.securityfocus.com/bid/27228Patch, Third Party Advisory, VDB Entry

Timeline

Published: Aug 4, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-34597.6Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbit CVE-2008-34609.3WPGIMP32.FLT in Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 does not properly parse the length of a CVE-2008-34647.2afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1 and SP2 does not pr CVE-2008-34659.8Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and CVE-2008-346610.0Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote atta CVE-2008-34719.3Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Of CVE-2008-34729.3Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att CVE-2008-34739.3Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att CVE-2008-34746.5Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att CVE-2008-34758.8Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (CVE-2008-34769.3Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remo CVE-2008-34779.3Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Off