Main Vulnerability Database Vulnerabilities #VU33660

Improper Authentication - CVE-2013-3215

Published: January 29, 2020 / Updated: August 4, 2020

Vulnerability identifier: #VU33660

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-3215

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.

Affected software

libcap-ng (Alpine package)
IBM Tivoli Storage Manager

How to mitigate CVE-2013-3215

Install update from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #3699 - vtiger CRM 5.4.0 (SOAP Services) - Multiple Vulnerabilities (August 4, 2020)
Exploit #3679 - vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload (August 4, 2020)

External References

http://www.securityfocus.com/bid/61559
https://exchange.xforce.ibmcloud.com/vulnerabilities/86163

Related Security Bulletins

Improper Authentication in libcap-ng (Alpine package)