Vulnerability · Published Sep 29, 2021 · Assigned by Mend

CVE-2021-25960SuiteCRM - CSV Injection in Accounts Module

High 8.0

In plain English

A high-severity security flaw in SuiteCRM from salesagility. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)1.2%top 31.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the data as a CSV file and opens it, the payload gets executed. This was not fixed properly as part of CVE-2020-15301, allowing the attacker to bypass the security measure.

Affected products (as reported)

Vendor	Product	Versions
salesagility	SuiteCRM	v7.10.29 – before v7.10v7.11.18 – before v7.11

Weakness: CWE-1236 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25960 x_refsource_MISC
https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513 x_refsource_MISC
https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648 x_refsource_MISC