#VU41779 Input validation error in Vtiger CRM - CVE-2014-2269


| Updated: 2020-08-10

Vulnerability identifier: #VU41779

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-2269

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Vtiger CRM
Other software / Other software solutions

Vendor: Vtiger

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Vtiger CRM: 6.0.0

External links
https://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html
https://www.securityfocus.com/bid/66758

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Input validation error in Vtiger CRM