4

CVE-2011-0745

Exploit
SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sugarcrm ≫ Sugarcrm Version <= 6.1.2
Sugarcrm ≫ Sugarcrm Version 1.0
Sugarcrm ≫ Sugarcrm Version 1.0f
Sugarcrm ≫ Sugarcrm Version 1.0g
Sugarcrm ≫ Sugarcrm Version 1.1
Sugarcrm ≫ Sugarcrm Version 1.1a
Sugarcrm ≫ Sugarcrm Version 1.1b
Sugarcrm ≫ Sugarcrm Version 1.1c
Sugarcrm ≫ Sugarcrm Version 1.1d
Sugarcrm ≫ Sugarcrm Version 1.1e
Sugarcrm ≫ Sugarcrm Version 1.1f
Sugarcrm ≫ Sugarcrm Version 1.5d
Sugarcrm ≫ Sugarcrm Version 2.0.1
Sugarcrm ≫ Sugarcrm Version 2.0.1a
Sugarcrm ≫ Sugarcrm Version 2.0.1c
Sugarcrm ≫ Sugarcrm Version 3.0.1
Sugarcrm ≫ Sugarcrm Version 3.5
Sugarcrm ≫ Sugarcrm Version 3.5.1
Sugarcrm ≫ Sugarcrm Version 4.0
Sugarcrm ≫ Sugarcrm Version 4.0.1
Sugarcrm ≫ Sugarcrm Version 4.1
Sugarcrm ≫ Sugarcrm Version 4.2
Sugarcrm ≫ Sugarcrm Version 4.2.1
Sugarcrm ≫ Sugarcrm Version 4.5.0
Sugarcrm ≫ Sugarcrm Version 4.5.0f
Sugarcrm ≫ Sugarcrm Version 4.5.1
Sugarcrm ≫ Sugarcrm Version 4.5.1 Edition community_edition
Sugarcrm ≫ Sugarcrm Version 4.5.1i
Sugarcrm ≫ Sugarcrm Version 4.5.1o
Sugarcrm ≫ Sugarcrm Version 5.0.0
Sugarcrm ≫ Sugarcrm Version 5.0.0 Edition community_edition
Sugarcrm ≫ Sugarcrm Version 5.0.0 Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.0.0h Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.0.0k Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.1.0 Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.1.0-beta Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.1c Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.1l
Sugarcrm ≫ Sugarcrm Version 5.2.0g
Sugarcrm ≫ Sugarcrm Version 5.2a
Sugarcrm ≫ Sugarcrm Version 5.2c
Sugarcrm ≫ Sugarcrm Version 5.2c Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.2d
Sugarcrm ≫ Sugarcrm Version 5.2d Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.2e
Sugarcrm ≫ Sugarcrm Version 5.2e Edition sugar_community_edition
Sugarcrm ≫ Sugarcrm Version 5.2f
Sugarcrm ≫ Sugarcrm Version 5.2g
Sugarcrm ≫ Sugarcrm Version 5.2h
Sugarcrm ≫ Sugarcrm Version 5.5 Update beta1
Sugarcrm ≫ Sugarcrm Version 5.5 Update beta2
Sugarcrm ≫ Sugarcrm Version 5.5.0
Sugarcrm ≫ Sugarcrm Version 5.5.1
Sugarcrm ≫ Sugarcrm Version 5.5.2
Sugarcrm ≫ Sugarcrm Version 5.5.3
Sugarcrm ≫ Sugarcrm Version 5.5.4
Sugarcrm ≫ Sugarcrm Version 5.5a
Sugarcrm ≫ Sugarcrm Version 6.0
Sugarcrm ≫ Sugarcrm Version 6.0.1
Sugarcrm ≫ Sugarcrm Version 6.0.2
Sugarcrm ≫ Sugarcrm Version 6.0.3
Sugarcrm ≫ Sugarcrm Version 6.1.0
Sugarcrm ≫ Sugarcrm Version 6.1.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.26% 0.927
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://securityreason.com/securityalert/8141
http://www.redteam-pentesting.de/advisories/rt-sa-2011-002
Exploit
http://www.securityfocus.com/archive/1/517027/100/0/threaded
http://www.securityfocus.com/bid/46885
http://www.securitytracker.com/id?1025222
http://www.vupen.com/english/advisories/2011/0675
https://exchange.xforce.ibmcloud.com/vulnerabilities/66110