Lucene search

GoogleOSV:BIT-SUITECRM-2024-36419

HistoryJun 12, 2024 - 7:36 a.m.

BIT-suitecrm-2024-36419

2024-06-1207:36:24

Google

osv.dev

suitecrm

open-source

vulnerability fix

host header injection

crm software

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.0%

JSON

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue.

CPENameOperatorVersion
suitecrmlt8.6.1

CPE	Name	Operator	Version
	suitecrm	lt	8.6.1

References

github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-3323-hjq3-c6vc

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.0%

JSON

Related for OSV:BIT-SUITECRM-2024-36419