How severe is CVE-2009-3248?

CVE-2009-3248 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2009-3248 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-3248?

CVE-2009-3248 affects Vtiger Vtiger Crm. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2009-3248?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2009-3248 published?

CVE-2009-3248 was published on 2009-09-18 and last updated on 2026-06-16.

CVE-2009-3248

CVE-2009-3248 is a medium-severity vulnerability in Vtiger Vtiger Crm with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-352.

Key facts

Severity: Medium (CVSS 2.0 base score 6.8)
EPSS exploit prediction: 1% (66th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-352
Affected product: Vtiger Vtiger Crm
Published: 2009-09-18
Last modified: 2026-06-16

Description

Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php.

Frequently asked questions

What is CVE-2009-3248?: Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php.
How severe is CVE-2009-3248?: CVE-2009-3248 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2009-3248 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2009-3248?: CVE-2009-3248 affects Vtiger Vtiger Crm. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2009-3248?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2009-3248 published?: CVE-2009-3248 was published on 2009-09-18 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:vtiger:vtiger_crm:5.0.4:*:*:*:*:*:*:*

More vulnerabilities in Vtiger Vtiger Crm

CVE-2020-22807 — Critical (CVSS 9.8): An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.
CVE-2013-3215 — Critical (CVSS 9.8): vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation…
CVE-2013-3214 — Critical (CVSS 9.8): vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
CVE-2024-44779 — Critical (CVSS 9.6): A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0…
CVE-2024-44778 — Critical (CVSS 9.6): A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0…
CVE-2024-44777 — Critical (CVSS 9.6): A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows…

All CVEs affecting Vtiger Vtiger Crm →

Other CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities

CVE-2025-32642 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This…
CVE-2025-23922 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a…
CVE-2017-5145 — Critical (CVSS 10.0): An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware…
CVE-2019-25729 — Critical (CVSS 9.8): PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute…
CVE-2025-48340 — Critical (CVSS 9.8): Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows…
CVE-2025-2907 — Critical (CVSS 9.8): The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing…

Browse all CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities →