CVE-2010-3911

Опубликовано: 26 нояб. 2010

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username (aka default_user_name) field or (2) the password field in a Users Login action to index.php, or (3) the label parameter in a Settings GetFieldInfo action to index.php, related to modules/Settings/GetFieldInfo.php.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*

Версия до 5.2.0 (включая)

cpe:2.3:a:vtiger:vtiger_crm:1.0:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:2.0:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:2.1:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:3:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:3.0:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:3.0:beta:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:3.2:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4:beta:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4:rc1:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4.0:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4.2:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4.2:*:validation:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:5.0.3:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:5.0.4:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:5.0.4:rc:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:5.1.0:*:*:*:*:*:*:*

cpe:2.3:a:vtiger:vtiger_crm:5.1.0:rc:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00365

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-f4vq-5p8h-hqjx

github

больше 3 лет назад