by Kastro
Paper/Archive/CVE-2024-36410

CVE-2024-36410

salesagility SuiteCRM — SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller

EPSS 0.4%CVSS 9.6
critical.is priorityof 100
36
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 36.1.361 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Affected

ProductAffectedFixed inSource
SuiteCRM< 7.14.4–CNA
SuiteCRM>= 8.0.0, < 8.6.1–CNA
suitecrm< 7.14.47.14.4CISA-ADP
suitecrm≤ 8.0.0–CISA-ADP
suitecrm< 8.6.18.6.1CISA-ADP

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq