Info

Disclosure

Aug 30, 2012

Discovery

Unknown

Dates

Exploit

Aug 30, 2012

Solution

Unknown

Description

SugarCRM contains a flaw that is triggered when the program fails to properly restrict access to the vcal_server.php script. This may allow a remote attacker to enumerate a username or email address.

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Solution: Solution Unknown
Exploit: Exploit Public
Disclosure: Vendor Verified, Third-party Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

OSVDB is not aware of a solution for this vulnerability.

Products

SugarCRM Inc.

SugarCRM

6.5.2

References

Exploit Database: 20981
Secunia Advisory ID: 50388
Related OSVDB ID: 85068 85078 85079 85080 85081 85111
Other Advisory URL: http://itsecuritysolutions.org/2012-08-30-SugarCRM-Community-Edition-6.5.2-multiple-vulnerabilities/

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/85112