Vulnerability · Published Jun 10, 2024 · Assigned by GitHub_M

CVE-2024-36407SuiteCRM unauthenticated user password reset on php7

Low 3.7

In plain English

A low-severity security flaw in SuiteCRM from salesagility. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 74.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Affected products (as reported)

Vendor	Product	Versions
salesagility	SuiteCRM	< 7.14.4>= 8.0.0, < 8.6.1

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952r x_refsource_CONFIRM