CVE-2024-49774
ModuleScanner flaws in SuiteCRM
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses token_get_all to parse PHP scripts and check the resulted AST against blacklists. But it doesn't take into account all scenarios. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SuiteCRM es una aplicación de software de gestión de relaciones con clientes (CRM) de código abierto y preparada para empresas. SuiteCRM se basa en la lista negra de funciones/métodos para evitar la instalación de MLP maliciosos. Pero estas comprobaciones se pueden omitir con algunas construcciones de sintaxis. SuiteCRM utiliza token_get_all para analizar scripts PHP y comprobar el AST resultante con listas negras. Pero no tiene en cuenta todos los escenarios. Este problema se ha solucionado en las versiones 7.14.6 y 8.7.1. Se recomienda a los usuarios que actualicen. No existen workarounds conocidas para esta vulnerabilidad.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-10-18 CVE Reserved
- 2024-11-05 CVE Published
- 2024-11-05 CVE Updated
- 2024-11-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (1)
URL | Tag | Source |
---|---|---|
https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-9v56-vhp4-x227 | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Salesagility Search vendor "Salesagility" | SuiteCRM Search vendor "Salesagility" for product "SuiteCRM" | < 7.14.6 Search vendor "Salesagility" for product "SuiteCRM" and version " < 7.14.6" | en |
Affected
| ||||||
Salesagility Search vendor "Salesagility" | SuiteCRM Search vendor "Salesagility" for product "SuiteCRM" | >= 8.0.0 < 8.7.1 Search vendor "Salesagility" for product "SuiteCRM" and version " >= 8.0.0 < 8.7.1" | en |
Affected
|