CVE-2011-4679

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7003Exploit, Vendor Advisory
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7004Exploit, Vendor Advisory
http://wiki.vtiger.com/index.php/Oct2011:ODUpdateVendor Advisory
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7003Exploit, Vendor Advisory
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7004Exploit, Vendor Advisory
http://wiki.vtiger.com/index.php/Oct2011:ODUpdateVendor Advisory

Timeline

Published: Dec 7, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-46804.3Multiple cross-site scripting (XSS) vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbit CVE-2011-46815.0Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-le CVE-2011-46826.4The JavaScript engine in Opera before 11.60 does not properly implement the in operator, which allows remote attackers to bypass the Same Or CVE-2011-468310.0Unspecified vulnerability in Opera before 11.60 has unknown impact and attack vectors, related to a "moderately severe issue."CVE-2011-468410.0Opera before 11.60 does not properly handle certificate revocation, which has unspecified impact and remote attack vectors related to "corne CVE-2011-46855.0Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web pa CVE-2011-46865.0Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (appl CVE-2011-46875.0Opera before 11.60 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified content on a web page, CVE-2011-46885.0Mozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading at CVE-2011-46895.0Microsoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same Origin Policy violations during IFRAME load CVE-2011-46905.0Opera 11.60 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, wh CVE-2011-46915.0Google Chrome 15.0.874.121 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loadi