// For flags

CVE-2024-49774

ModuleScanner flaws in SuiteCRM

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses token_get_all to parse PHP scripts and check the resulted AST against blacklists. But it doesn't take into account all scenarios. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

SuiteCRM es una aplicación de software de gestión de relaciones con clientes (CRM) de código abierto y preparada para empresas. SuiteCRM se basa en la lista negra de funciones/métodos para evitar la instalación de MLP maliciosos. Pero estas comprobaciones se pueden omitir con algunas construcciones de sintaxis. SuiteCRM utiliza token_get_all para analizar scripts PHP y comprobar el AST resultante con listas negras. Pero no tiene en cuenta todos los escenarios. Este problema se ha solucionado en las versiones 7.14.6 y 8.7.1. Se recomienda a los usuarios que actualicen. No existen workarounds conocidas para esta vulnerabilidad.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-10-18 CVE Reserved
  • 2024-11-05 CVE Published
  • 2024-11-05 CVE Updated
  • 2024-11-14 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Salesagility
Search vendor "Salesagility"
 SuiteCRM
Search vendor "Salesagility" for product "SuiteCRM"
 < 7.14.6
Search vendor "Salesagility" for product "SuiteCRM" and version " < 7.14.6"
en
Affected
Salesagility
Search vendor "Salesagility"
 SuiteCRM
Search vendor "Salesagility" for product "SuiteCRM"
 >= 8.0.0 < 8.7.1
Search vendor "Salesagility" for product "SuiteCRM" and version " >= 8.0.0 < 8.7.1"
en
Affected