suitecrm

Vulnerabilities (74)

• CVE-2022-27474HigApr 15, 2022
  affected >= 7.11.23, < 7.11.24fixed 7.11.24

  SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.

• CVE-2022-23940HigMar 10, 2022
  affected < 7.12.5fixed 7.12.5

  SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious

• CVE-2022-0756MedMar 7, 2022
  affected < 7.12.5fixed 7.12.5

  Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.

• CVE-2022-0755MedMar 7, 2022
  affected < 7.12.5fixed 7.12.5

  Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.

• CVE-2022-0754MedMar 7, 2022
  affected < 7.12.5fixed 7.12.5

  SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.

• CVE-2021-45899CriJan 28, 2022
  affected < 7.12.3fixed 7.12.3

  SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.

• CVE-2021-45898CriJan 28, 2022
  affected < 7.12.3fixed 7.12.3

  SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.

• CVE-2021-45897HigJan 28, 2022
  affected < 7.12.3fixed 7.12.3

  SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.

• CVE-2021-41597HigJan 12, 2022
  affected >= 7.10.0, < 7.10.35fixed 7.10.35

  SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.

• CVE-2021-45903MedDec 28, 2021
  affected < 7.10.35fixed 7.10.35

  A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

• CVE-2021-45041HigDec 19, 2021
  affected < 7.12.2fixed 7.12.2

  SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_date.

• CVE-2021-42840HigOct 22, 2021
  affected < 7.11.19fixed 7.11.19

  SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file

• CVE-2021-41596MedOct 4, 2021
  affected < 7.10.33fixed 7.10.33

  SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.

• CVE-2021-41595MedOct 4, 2021
  affected < 7.10.33fixed 7.10.33

  SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.

• CVE-2021-41869HigOct 4, 2021
  affected >= 7.10.0, < 7.10.33fixed 7.10.33

  SuiteCRM 7.10.x before 7.10.33 and 7.11.x before 7.11.22 is vulnerable to privilege escalation.

• CVE-2021-25961HigSep 29, 2021
  affected >= 7.1.7, < 7.10.32fixed 7.10.32

  In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.

• CVE-2021-25960HigSep 29, 2021
  affected >= 7.10.29, < 7.10.32fixed 7.10.32

  In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts mo

• CVE-2021-39268MedAug 18, 2021
  affected < 7.11.19fixed 7.11.19

  Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed.

• CVE-2021-39267MedAug 18, 2021
  affected < 7.11.19fixed 7.11.19

  Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaSc

• CVE-2021-31792MedApr 30, 2021
  affected < 7.11.19fixed 7.11.19

  XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field