The vulnerability is located in the RSS Feed Dashlet of SuiteCRM. It enables a Server‑Side Request Forgery that is coupled with a Denial of Service condition. An attacker can instruct the CRM server to retrieve arbitrary URLs, potentially accessing internal resources or exhausting network sockets and memory, which results in service interruption.

SuiteCRM versions older than 7.15.1 and 8.9.3 are affected. The patch is available in those specific release versions.

The CVSS base score of 7.1 indicates high severity, while the EPSS score is below 1%, reflecting a relatively low current exploitation probability. It does not appear in the CISA KEV catalog. The likely attack vector would involve an attacker adding or modifying an RSS feed URL within the dashlet; this is inferred from the description and the nature of the component, as explicit authentication requirements are not stated in the advisory.