Lucene search

GitHub_MCVELIST:CVE-2024-36419

HistoryJun 10, 2024 - 9:15 p.m.

CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy

2024-06-1021:15:37

CWE-601

GitHub_M

www.cve.org

suitecrm

customer relationship management

host header injection

legacy route

vulnerability

patch

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

26.0%

JSON

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue.

CNA Affected

[
  {
    "vendor": "salesagility",
    "product": "SuiteCRM-Core",
    "versions": [
      {
        "version": "< 8.6.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-3323-hjq3-c6vc

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

26.0%

JSON

Related for CVELIST:CVE-2024-36419