CVE-2024-36412

2024-06-1020:15:13

CWE-89

[email protected]

web.nvd.nist.gov

suitecrm

open-source

crm

sql injection

vulnerability

fixed

7.14.4

8.6.1

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

0.048 Low

EPSS

Percentile

92.8%

JSON

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Affected configurations

Vulners

NVD

Node

salesagilitysuitecrmRange<7.14.4

salesagilitysuitecrmRange8.0.0–8.6.1

CPENameOperatorVersion
salesagility:suitecrmsalesagility suitecrmlt7.14.4
salesagility:suitecrmsalesagility suitecrmlt8.6.1

CPE	Name	Operator	Version
salesagility:suitecrm	salesagility suitecrm	lt	7.14.4
salesagility:suitecrm	salesagility suitecrm	lt	8.6.1

CNA Affected

[
  {
    "vendor": "salesagility",
    "product": "SuiteCRM",
    "versions": [
      {
        "version": "< 7.14.4",
        "status": "affected"
      },
      {
        "version": ">= 8.0.0, < 8.6.1",
        "status": "affected"
      }
    ]
  }
]