Authenticated RCE using connectors

High

jack7anderson7 published GHSA-mfj5-37v4-vh5w

Jun 10, 2024

Package

SuiteCRM

Affected versions

<= 7.14.3

<= 8.6.0

Patched versions

7.14.4

8.6.1

Description

Impact

What kind of vulnerability is it? Who is impacted?

Vulnerability in connectors allows authenticated user to do RCE attack

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

Severity

High

8.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H