CVE-2020-19363 – Vtiger CRM v7.2.0 allows an attacker to display hidden files, list direct

Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19363

Reference (s):

• https://emreovunc.com/blog/en/vtiger_crm_directorylisting_01.png
• https://emreovunc.com/blog/en/vtiger_crm_directorylisting_02.png
• https://github.com/EmreOvunc/Vtiger-CRM-Vulnerabilities/