CVE-2024-45392: fallo de gravedad alta en salesagility SuiteCRM
SuiteCRM has wrong deletion permission checks on API delete call
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.7epss 0.3%
SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Productos afectados
salesagility · SuiteCRMCVEs relacionadas — salesagility SuiteCRM
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-36412CRITICALSuiteCRM unauthenticated SQL InjectionEPSS 5.7%CVE-2024-36416HIGHSuiteCRM v4 API Excessive log data DOSEPSS 2.0%CVE-2021-25960HIGHSuiteCRM - CSV Injection in Accounts ModuleEPSS 1.2%CVE-2021-25961HIGHSuiteCRM - Account Takeover in Password Reset FunctionalityEPSS 1.0%CVE-2024-36415CRITICALSuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code executionEPSS 0.9%CVE-2024-36418HIGHSuiteCRM authenticated RCE using connectorsEPSS 0.8%