CVE-2011-0745 - CVE House
Back to Database
Status published Medium CVE-2011-0745

SugarCRM before 6.1.3 does not properly handle reloads and direct...

Vulnerability Description

SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-0745

Credits & Attribution

No credits recorded in the NVD database.

References

More from sugarcrm

View All →
CVE-2020-7472
An authorization bypass and PHP local-file-include vulnerability in the installation...
Critical 9.8
CVE-2020-36501
Multiple cross-site scripting (XSS) vulnerabilities in the Support module of...
Medium 5.4
CVE-2020-28956
Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of...
Medium 5.4
CVE-2020-28955
SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS)...
Medium 5.4
CVE-2020-17373
SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection....
Medium 5.3

Affected Vendor

Affected Software

sugarcrm
Vulnerable Versions:
0, 1.0, 1.0f, 1.0g, 1.1, 1.1a, 1.1b, 1.1c, 1.1d, 1.1e, 1.1f, 1.5d, 2.0.1, 2.0.1a, 2.0.1c, 3.0.1, 3.5, 3.5.1, 4.0, 4.0.1, 4.1, 4.2, 4.2.1, 4.5.0, 4.5.0f, 4.5.1, 4.5.1i, 4.5.1o, 5.0.0, 5.0.0h, 5.0.0k, 5.1.0, 5.1.0-beta, 5.1c, 5.1l, 5.2.0g, 5.2a, 5.2c, 5.2d, 5.2e, 5.2f, 5.2g, 5.2h, 5.5, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5a, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.1.0, 6.1.1

Timeline

Official Publish: March 16th, 2011
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.