SugarCRM Information Disclosure Vulnerability

Bugtraq ID:	46885
Class:	Access Validation Error
CVE:	CVE-2011-0745
Remote:	Yes
Local:	No
Published:	Mar 15 2011 12:00AM
Updated:	Mar 15 2011 12:00AM
Credit:	RedTeam Pentesting GmbH
Vulnerable:	SugarCRM SugarCRM 5.2 j SugarCRM SugarCRM 5.2 i SugarCRM SugarCRM 5.2 h SugarCRM SugarCRM 5.2 g SugarCRM SugarCRM 5.2 e SugarCRM SugarCRM 5.0 m SugarCRM SugarCRM 5.0 l SugarCRM SugarCRM 5.0 k SugarCRM SugarCRM 6.1.1 SugarCRM SugarCRM 5.5.0a SugarCRM SugarCRM 5.5.0.RC4 SugarCRM SugarCRM 5.5.0.RC2 SugarCRM SugarCRM 5.2.0l SugarCRM SugarCRM 5.2.0k SugarCRM SugarCRM 5.2.0j
Not Vulnerable:	SugarCRM SugarCRM 6.1.3

SugarCRM Information Disclosure Vulnerability

SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

SugarCRM Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://www.example.org/sugarcrm/index.php?module=Accounts&action=ShowDuplicates

http://www.example.org/sugarcrm/index.php?module=Contacts&action=ShowDuplicates

SugarCRM Information Disclosure Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

SugarCRM Information Disclosure Vulnerability

References:

• SugarCRM Homepage (SugarCRM)
  
• [RT-SA-2011-002] SugarCRM list privilege restriction bypass (RedTeam Pentesting GmbH )