by Kastro
Paper/Archive/CVE-2024-1644

CVE-2024-1644

Suite CRM Suite CRM — Suite CRM v7.14.2 - RCE via Local File Inclusion

EPSS 0.9%CVSS 9.9
critical.is priorityof 100
41
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 58.4.584 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI.

Affected

ProductAffectedFixed inSource
Suite CRM7.14.2–CNA

Scores by source

Fluid Attacks (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/salesagility/SuiteCRMreffluidattacks.com/advisories/silva