CVE-2024-36410 - Vulnerability Details - OpenCVE

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00065.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Salesagility	Suitecrm

Configuration 1 [-]

OR	cpe:2.3:a:salesagility:suitecrm::::::::
	cpe:2.3:a:salesagility:suitecrm::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-36067	SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-06-10T17:24:08.514Z

Updated: 2024-08-02T03:37:04.984Z

Reserved: 2024-05-27T15:59:57.031Z

Link: CVE-2024-36410

Vulnrichment

Updated: 2024-06-11T17:12:28.685Z

NVD

Status : Modified

Published: 2024-06-10T18:15:35.830

Modified: 2024-11-21T09:22:07.273

Link: CVE-2024-36410

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36410", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-05-27T15:59:57.031Z", "datePublished": "2024-06-10T17:24:08.514Z", "dateUpdated": "2024-08-02T03:37:04.984Z"}, "containers": {"cna": {"title": "SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller ", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq"}], "affected": [{"vendor": "salesagility", "product": "SuiteCRM", "versions": [{"version": "< 7.14.4", "status": "affected"}, {"version": ">= 8.0.0, < 8.6.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-10T17:24:08.514Z"}, "descriptions": [{"lang": "en", "value": "SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue."}], "source": {"advisory": "GHSA-7jj8-m2wj-m6xq", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "salesagility", "product": "suitecrm", "cpes": ["cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.14.4", "versionType": "custom"}]}, {"vendor": "salesagility", "product": "suitecrm", "cpes": ["cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.0.0", "versionType": "custom"}]}, {"vendor": "salesagility", "product": "suitecrm", "cpes": ["cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.6.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-11T17:08:54.773534Z", "id": "CVE-2024-36410", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T17:16:13.551Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:04.984Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36410", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-11T17:08:54.773534Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"], "vendor": "salesagility", "product": "suitecrm", "versions": [{"status": "affected", "version": "0", "lessThan": "7.14.4", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"], "vendor": "salesagility", "product": "suitecrm", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.0.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"], "vendor": "salesagility", "product": "suitecrm", "versions": [{"status": "affected", "version": "0", "lessThan": "8.6.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T17:12:28.685Z"}}], "cna": {"title": "SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller ", "source": {"advisory": "GHSA-7jj8-m2wj-m6xq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "salesagility", "product": "SuiteCRM", "versions": [{"status": "affected", "version": "< 7.14.4"}, {"status": "affected", "version": ">= 8.0.0, < 8.6.1"}]}], "references": [{"url": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq", "name": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-10T17:24:08.514Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36410", "state": "PUBLISHED", "dateUpdated": "2024-06-11T17:16:13.551Z", "dateReserved": "2024-05-27T15:59:57.031Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-10T17:24:08.514Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*", "matchCriteriaId": "176C4E20-B96D-4391-986F-3314663983AC", "versionEndExcluding": "7.14.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*", "matchCriteriaId": "5249169E-5516-4705-A2C8-DE1BA56497D0", "versionEndExcluding": "8.6.1", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue."}, {"lang": "es", "value": "SuiteCRM es una aplicaci\u00f3n de software de gesti\u00f3n de relaciones con el cliente (CRM) de c\u00f3digo abierto. En versiones anteriores a 7.14.4 y 8.6.1, una validaci\u00f3n de entrada deficiente permite la inyecci\u00f3n de SQL en el controlador de recuento de mensajes EmailUIAjax. Las versiones 7.14.4 y 8.6.1 contienen una soluci\u00f3n para este problema."}], "id": "CVE-2024-36410", "lastModified": "2024-11-21T09:22:07.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-10T18:15:35.830", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}