CVE-2010-3909

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the…

published November 26, 2010

CVSS
—
EPSS
2%
Percentile
75.7
In the wild
Unconfirmed
What it is

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01608 · 75.7th percentile
Published
2010-11-26T19:00Z
EPSS history
Timeline
  • 26 NOV 19:00Z
    Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the…
    cvelistv5