CVE-2023-6388

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6388
Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4
https://fluidattacks.com/advisories/leon/ Exploit Third Party Advisory
https://github.com/salesagility/SuiteCRM/ Product
https://fluidattacks.com/advisories/leon/ Exploit Third Party Advisory
https://github.com/salesagility/SuiteCRM/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:salesagility:suitecrm:7.14.2:*:*:*:*:*:*:*
History

29 Sep 2025, 18:15

Type Values Removed Values Added
References
  • () https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4 -
Summary (en) Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF. (en) Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF.

21 Nov 2024, 08:43

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/leon/ - Exploit, Third Party Advisory () https://fluidattacks.com/advisories/leon/ - Exploit, Third Party Advisory
References () https://github.com/salesagility/SuiteCRM/ - Product () https://github.com/salesagility/SuiteCRM/ - Product

14 Feb 2024, 20:15

Type Values Removed Values Added
CPE cpe:2.3:a:salesagility:suitecrm:7.14.2:*:*:*:*:*:*:*
First Time Salesagility suitecrm
Salesagility
References () https://fluidattacks.com/advisories/leon/ - () https://fluidattacks.com/advisories/leon/ - Exploit, Third Party Advisory
References () https://github.com/salesagility/SuiteCRM/ - () https://github.com/salesagility/SuiteCRM/ - Product

07 Feb 2024, 13:41

Type Values Removed Values Added
Summary
  • (es) La versión 7.14.2 de Suite CRM permite realizar solicitudes HTTP arbitrarias a través del servidor vulnerable. Esto es posible porque la aplicación es vulnerable a SSRF.

07 Feb 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-07 03:15

Updated : 2025-09-29 18:15

NVD link : CVE-2023-6388

Mitre link : CVE-2023-6388

CVE.ORG link : CVE-2023-6388

JSON object : View

Products Affected

salesagility

  • suitecrm
CWE
CWE-918

Server-Side Request Forgery (SSRF)