Modification of user accounts in Vtiger CRM - CVE-2016-4834
Published: August 2, 2016
Vulnerability identifier: #VU256
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-4834
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify user data on the target system.
The vulnerability exists due to a flaw in 'modules/Users/actions/Save.php' in the Users_Save_Action class. A remote authenticated attacker can create or modify user accounts via unspecified vectors.
Successful exploitation of this vulnerability may result in modification of system information.
The vulnerability exists due to a flaw in 'modules/Users/actions/Save.php' in the Users_Save_Action class. A remote authenticated attacker can create or modify user accounts via unspecified vectors.
Successful exploitation of this vulnerability may result in modification of system information.
Affected software
Vtiger CRM
How to mitigate CVE-2016-4834
A source code fix is available at:
http://code.vtiger.com/vtiger/vtigercrm/commit/7cdf9941197b4aa58114eafce3ce88fb418eb68c
http://code.vtiger.com/vtiger/vtigercrm/commit/7cdf9941197b4aa58114eafce3ce88fb418eb68c