CVE-2011-0745

CVSS V2 Medium 4 CVSS V3 None
Description
SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.
Overview
  • CVE ID
  • CVE-2011-0745
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2011-03-16T22:55:02
  • Last Modified Date
  • 2018-10-09T19:29:43
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:* 1 OR 6.1.2
cpe:2.3:a:sugarcrm:sugarcrm:1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.0f:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.0g:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.1a:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.1b:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.1c:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.1d:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.1e:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.1f:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:1.5d:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:2.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:2.0.1a:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:2.0.1c:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:3.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:3.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:3.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.5.0f:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.5.1:*:community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.5.1i:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:4.5.1o:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.0.0:*:community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.0.0:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.0.0h:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.0.0k:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.1.0:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.1.0-beta:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.1c:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.1l:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2.0g:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2a:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2c:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2c:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2d:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2d:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2e:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2e:*:sugar_community_edition:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2f:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2g:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.2h:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:5.5a:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:6.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:6.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:6.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:6.1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:sugarcrm:sugarcrm:6.1.1:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:S/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 4
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.redteam-pentesting.de/advisories/rt-sa-2011-002 Exploit
http://www.vupen.com/english/advisories/2011/0675
http://www.securitytracker.com/id?1025222
http://www.securityfocus.com/bid/46885
http://securityreason.com/securityalert/8141
https://exchange.xforce.ibmcloud.com/vulnerabilities/66110
http://www.securityfocus.com/archive/1/517027/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2011-0745
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0745
History
Created Old Value New Value Data Type Notes
2022-05-10 18:36:01 Added to TrackCVE