Metrics
Affected Vendors & Products
| Source | ID | Title | 
|---|---|---|
|  EUVD | EUVD-2023-58237 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution. | 
Solution
Users with administrator profile can load extensions and updates by design, as this is a functionality that most users use and request. It is possible to restrict exploitation of the vulnerability by enabling the "restrictedMode" option in the configuration menu.
Workaround
No workaround given by the vendor.
Tue, 03 Jun 2025 14:15:00 +0000
| Type | Values Removed | Values Added | 
|---|---|---|
| Metrics | ssvc 
 | 
 MITRE
                        MITRE
                    Status: PUBLISHED
Assigner: INCIBE
Published:
Updated: 2025-06-03T13:52:15.298Z
Reserved: 2023-11-06T13:18:11.772Z
Link: CVE-2023-5966
 Vulnrichment
                        Vulnrichment
                    Updated: 2024-08-02T08:14:25.144Z
 NVD
                        NVD
                    Status : Modified
Published: 2023-11-30T14:15:13.450
Modified: 2024-11-21T08:42:52.887
Link: CVE-2023-5966
 Redhat
                        Redhat
                    No data.
 OpenCVE Enrichment
                        OpenCVE Enrichment
                    No data.