by Kastro
Paper/Archive/CVE-2024-36409

CVE-2024-36409

salesagility SuiteCRM — SuiteCRM authenticated SQL Injection in TreeData entrypoint

EPSS 0.4%CVSS 9.6
critical.is priorityof 100
36
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 37.8.378 × 207.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Affected

ProductAffectedFixed inSource
SuiteCRM< 7.14.4–CNA
SuiteCRM>= 8.0.0, < 8.6.1–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f