CVE-2009-3257

Severity: low (CVSS 3.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-09-18 · updated 2026-06-16
Weakness: CWE-264

Description

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a profile by creating a Sales Order (SO) associated with that profile.

Affected products

Vtiger CRM: before 5.1.0 — fixed in 5.1.0

How to fix

Upgrade to a fixed version: Vtiger CRM 5.1.0. Check the vendor advisory for mitigations.

References

http://secunia.com/advisories/36309
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5055
http://secunia.com/advisories/36309
http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5055

Get alerted when CVE-2009-3257 or the next vulnerability affects your stack