Bypassing Access Restrictions in vtiger CRM Leads Module

CVE-2011-4679 · MEDIUM Severity

AV:N/AC:L/AU:S/C:N/I:P/A:N

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report.

Learn more about our Crm Penetration Testing.