// For flags

CVE-2022-23940

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.

SuiteCRM versiones hasta 7.12.1 y versiones 8.x hasta 8.0.1, permite una Ejecución de Código Remota. Los usuarios autenticados con acceso al módulo de Informes Programados pueden lograr esto al aprovechar la deserialización de PHP en la propiedad email_recipients. Usando una petición diseñada, pueden crear un informe malicioso que contenga una carga útil de deserialización PHP en el campo email_recipients. Una vez que alguien acceda a este informe, el backend deserializará el contenido del campo email_recipients y la carga útil será ejecutada. Las dependencias del proyecto incluyen una serie de interesantes gadgets de deserialización de PHP (por ejemplo, Monolog/RCE1 de phpggc) que pueden ser usados para una Ejecución de Código

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-01-25 CVE Reserved
  • 2022-03-07 CVE Published
  • 2022-03-11 First Exploit
  • 2024-08-03 CVE Updated
  • 2024-08-19 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Salesagility
Search vendor "Salesagility"
 Suitecrm
Search vendor "Salesagility" for product "Suitecrm"
 < 7.12.5
Search vendor "Salesagility" for product "Suitecrm" and version " < 7.12.5"
-
Affected
Salesagility
Search vendor "Salesagility"
 Suitecrm
Search vendor "Salesagility" for product "Suitecrm"
 >= 8.0 < 8.0.4
Search vendor "Salesagility" for product "Suitecrm" and version " >= 8.0 < 8.0.4"
-
Affected