CVE-2024-49772

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all data in database. This issue has been addressed in releases 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Reserved 2024-10-18 | Published 2024-11-05 | Updated 2024-11-05 | Assigner GitHub_M

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

< 7.14.6
affected

>= 8.0.0, < 8.7.1
affected

References

github.com/...iteCRM/security/advisories/GHSA-4xj8-hr85-hm3m

cve.org (CVE-2024-49772)

nvd.nist.gov (CVE-2024-49772)

Download JSON