Lucene search

GoogleOSV:BIT-SUITECRM-2024-36412

HistoryJun 12, 2024 - 7:38 a.m.

BIT-suitecrm-2024-36412

2024-06-1207:38:05

Google

osv.dev

suitecrm

open-source

customer relationship management

crm

sql injection

vulnerability

fix

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.7 High

AI Score

Confidence

Low

0.048 Low

EPSS

Percentile

92.8%

JSON

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CPENameOperatorVersion
suitecrmlt8.6.1
suitecrmlt7.14.4
suitecrmge8.0.0

Name	Operator	Version
suitecrm	lt	8.6.1
suitecrm	lt	7.14.4
suitecrm	ge	8.0.0

References

github.com/salesagility/SuiteCRM/security/advisories/GHSA-xjx2-38hv-5hh8

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.7 High

AI Score

Confidence

Low

0.048 Low

EPSS

Percentile

92.8%

JSON

Related for OSV:BIT-SUITECRM-2024-36412