How severe is CVE-2020-19363?

CVE-2020-19363 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2020-19363 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (88th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-19363?

CVE-2020-19363 affects Vtiger Vtiger Crm. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-19363?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-19363 published?

CVE-2020-19363 was published on 2021-01-20 and last updated on 2026-06-17.

CVE-2020-19363

CVE-2020-19363 is a medium-severity vulnerability in Vtiger Vtiger Crm with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-200.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.3
EPSS exploit prediction: 4% (88th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-200
Affected product: Vtiger Vtiger Crm
Published: 2021-01-20
Last modified: 2026-06-17

Description

Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.

Frequently asked questions

What is CVE-2020-19363?: Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.
How severe is CVE-2020-19363?: CVE-2020-19363 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2020-19363 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (88th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-19363?: CVE-2020-19363 affects Vtiger Vtiger Crm. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-19363?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-19363 published?: CVE-2020-19363 was published on 2021-01-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:vtiger:vtiger_crm:7.2.0:*:*:*:*:*:*:*

More vulnerabilities in Vtiger Vtiger Crm

CVE-2020-22807 — Critical (CVSS 9.8): An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.
CVE-2013-3215 — Critical (CVSS 9.8): vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation…
CVE-2013-3214 — Critical (CVSS 9.8): vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
CVE-2024-44779 — Critical (CVSS 9.6): A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0…
CVE-2024-44778 — Critical (CVSS 9.6): A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0…
CVE-2024-44777 — Critical (CVSS 9.6): A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows…

All CVEs affecting Vtiger Vtiger Crm →

Other CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities

CVE-2026-27604 — Critical (CVSS 10.0): FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version…
CVE-2026-40965 — Critical (CVSS 10.0): Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a…
CVE-2026-42826 — Critical (CVSS 10.0): Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose…
CVE-2025-29270 — Critical (CVSS 10.0): Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows…
CVE-2025-61481 — Critical (CVSS 10.0): An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by…
CVE-2025-53624 — Critical (CVSS 10.0): The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user.…

Browse all CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities →