CVE-2011-4679

Description

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report.

Primary references

• cve@mitre.org — Exploit, Vendor Advisory
• cve@mitre.org — Exploit, Vendor Advisory
• cve@mitre.org — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory