Test ID:	1.3.6.1.4.1.25623.1.0.804748
Category:	Web application abuses
Title:	vTiger CRM 'file' Arbitrary File Disclosure Vulnerability
Summary:	Vtiger CRM is prone to arbitrary file disclosure vulnerability.
Description:	Summary: Vtiger CRM is prone to arbitrary file disclosure vulnerability. Vulnerability Insight: Flaw is due to the /kcfinder/browse.php script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the 'file' parameter. Vulnerability Impact: Successful exploitation will allow an authenticated remote attacker to gain access to arbitrary files. Affected Software/OS: Vtiger CRM version 6.0.0 and prior. Solution: Apply the patch 'Vtiger CRM 6.0.0 Security patch 1' or upgrade to the latest version. CVSS Score: 4.0 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-1222 Bugtraq: 20140312 CVE-2014-1222 - Local File Inclusion in Vtiger CRM (Google Search) http://www.securityfocus.com/archive/1/531423/100/0/threaded https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1222/
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.