CVE-2007-3598

CVE-2007-3598 describes an information disclosure vulnerability in vtiger CRM versions prior to 5.0.3. An authenticated attacker could exploit a flaw in index.php by manipulating the 'record' parameter within a DetailView action to the Users module, potentially gaining access to all user names and email addresses. While the vendor disputes the ability to change user settings, the CVSS score of 5.5 indicates a medium severity risk with low attack complexity and partial confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.