Vulnerability · Published Nov 21, 2023 · Assigned by GitHub_M

CVE-2023-47643SuiteCRM has Unauthenticated Graphql Introspection Enabled

Low 3.1

In plain English

A low-severity information exposure in SuiteCRM-Core from salesagility. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)3.0%top 12.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
salesagility	SuiteCRM-Core	< 8.4.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrr x_refsource_CONFIRM
https://github.com/salesagility/SuiteCRM-Core/commit/117dd8172793a239f71c91222606bf00677eeb33 x_refsource_MISC
https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/ x_refsource_MISC