CVE-2022-23940

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the emailrecipients property. By using a crafted request, they can create a malicious report, containin...

CVE-2022-23940

SuiteCRM remote code execution (CVE-2022-23940) affects 7.12.1 and 8.x up to 8.0.1. Exploitation relies on deserializing crafted data in email_recipients within the Scheduled Reports module, allowing an authenticated user to trigger PHP object deserialization and execute code. The description not...

CVE-2022-23940: Deserialization of Untrusted Data

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the emailrecipients property. By using a crafted request, they can create a malicious report, containin...