CVE-2020-15958

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-09-18 · updated 2026-06-17
Weakness: CWE-639

Description

An issue was discovered in 1CRM System through 8.6.7. An insecure direct object reference to internally stored files allows a remote attacker to access various sensitive information via an unauthenticated request with a predictable URL.

Affected products

1Crm: through 8.6.7

References

http://packetstormsecurity.com/files/159193/1CRM-8.6.7-Insecure-Direct-Object-Reference.html
http://seclists.org/fulldisclosure/2020/Sep/31
https://1crm.com/documentation/
https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-1crm-schutzt-daten-unzureichend-cve-2020-15958
http://packetstormsecurity.com/files/159193/1CRM-8.6.7-Insecure-Direct-Object-Reference.html
http://seclists.org/fulldisclosure/2020/Sep/31
https://1crm.com/documentation/
https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-1crm-schutzt-daten-unzureichend-cve-2020-15958

Get alerted when CVE-2020-15958 or the next vulnerability affects your stack