Paper/Archive/CVE-2024-36415

CVE-2024-36415

salesagility SuiteCRM — SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution

EPSS 0.9%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 59.2.592 × 2011.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Affected

ProductAffectedFixed inSource

SuiteCRM< 7.14.4–CNA

SuiteCRM>= 8.0.0, < 8.6.1–CNA

suitecrm< 7.14.47.14.4CISA-ADP

suitecrm< 8.6.18.6.1CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/salesagility/SuiteCRM/security/advisories/GHSA-c82f-58jv-jfrh