CVE-2013-3215 : vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due

vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.

Published 2020-01-29 18:15:12

Updated 2020-01-31 19:54:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2013-3215

Vtiger » Vtiger Crm
Versions from including (>=) 5.1.0 and up to, including, (<=) 5.4.0
cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2013-3215

EPSS FAQ

17.34%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2013-3215

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload

Disclosure Date: 2013-03-26

First seen: 2020-04-26

exploit/multi/http/vtiger_soap_upload

vTiger CRM allows a user to bypass authentication when requesting SOAP services. In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP service. By combining both vulnerabilities an attacker can upload and execute PHP code. This mo

More information

CVSS scores for CVE-2013-3215

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2013-3215

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-3215

https://exchange.xforce.ibmcloud.com/vulnerabilities/86163

Vtiger CRM validateSession() security bypass CVE-2013-3215 Vulnerability Report
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/61559

vtiger CRM 'validateSession()' Authentication Bypass Vulnerability
Third Party Advisory;VDB Entry

Jump to