vtenext CRM flaws let attackers hijack logged-in accounts
Customer management software can let attackers take over accounts and steal data.
Summary
Several web flaws in vtenext CRM before 25.02.2 let attackers hijack logged-in user sessions and read database data. Organizations running affected on-premises or cloud installs are exposed.
Affected when
- vtenext before 25.02.2
- a logged-in user opens a crafted request or link
What to do
Update to vtenext 25.02.2 or later.
Products and platforms
CVE IDs
Sources
- Advisory: usermanual.vtenext.com (opens in a new tab)
- Write-up: blog.sicuranext.com (opens in a new tab) · 0xbro.red (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen