Description
modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters.
References
- 66758 vdb-entry
- [Vtigercrm-developers] 20140316 IMP: forgot password and re-installation security fix mailing-list