CVE-2024-36409

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f	Vendor Advisory
https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:salesagility:suitecrm::::::::
	cpe:2.3:a:salesagility:suitecrm::::::::

History

21 Nov 2024, 09:22

Type	Values Removed	Values Added
References	~~() https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f - Vendor Advisory~~	() https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~8.8~~	v2 : unknown v3 : 9.6

12 Jun 2024, 18:09

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.6~~	v2 : unknown v3 : 8.8
CPE		cpe:2.3:a:salesagility:suitecrm::::::::
Summary		(es) SuiteCRM es una aplicación de software de gestión de relaciones con el cliente (CRM) de código abierto. En versiones anteriores a 7.14.4 y 8.6.1, una validación de entrada deficiente permite la inyección SQL en el punto de entrada de datos del Tree. Las versiones 7.14.4 y 8.6.1 contienen una solución para este problema.
First Time		Salesagility Salesagility suitecrm
References	~~() https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f -~~	() https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f - Vendor Advisory

10 Jun 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-10 18:15

Updated : 2024-11-21 09:22

NVD link : CVE-2024-36409

Mitre link : CVE-2024-36409

CVE.ORG link : CVE-2024-36409

JSON object : View

Products Affected

salesagility

suitecrm

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-36409", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-06-10T18:15:35.620", "references": [{"url": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue."}, {"lang": "es", "value": "SuiteCRM es una aplicaci\u00f3n de software de gesti\u00f3n de relaciones con el cliente (CRM) de c\u00f3digo abierto. En versiones anteriores a 7.14.4 y 8.6.1, una validaci\u00f3n de entrada deficiente permite la inyecci\u00f3n SQL en el punto de entrada de datos del Tree. Las versiones 7.14.4 y 8.6.1 contienen una soluci\u00f3n para este problema."}], "lastModified": "2024-11-21T09:22:07.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "176C4E20-B96D-4391-986F-3314663983AC", "versionEndExcluding": "7.14.4"}, {"criteria": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5249169E-5516-4705-A2C8-DE1BA56497D0", "versionEndExcluding": "8.6.1", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}