nvd-json-data-feeds/CVE-2023/CVE-2023-463xx/CVE-2023-46304.json

{
  "id": "CVE-2023-46304",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2024-04-30T13:15:46.763",
  "lastModified": "2024-04-30T17:52:35.057",
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load)."
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/jselliott/CVE-2023-46304",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.vtiger.com/",
      "source": "cve@mitre.org"
    }
  ]
}