Anderson7

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Before versions 7.15.1 and 8.9.3, the REST API V8 lacks Access Control List (ACL) checks on several endpoints. This allows authenticated users to access and manipulate data they are not permitted to interact with. The API endpoints are affected. The vulnerable parameters or variables are not specified. **Recommendations** Update to SuiteCRM version 7.15.1 or later. Update to SuiteCRM version 8.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.9.3, the `RecordHandler::getRecord()` method retrieves records based on module and ID without verifying the current user’s access permissions for viewing. The `saveRecord()` method correctly checks access permissions for saving, but `getRecord()` bypasses the equivalent check for viewing. This could allow unauthorized access to sensitive information. **Recommendations** Update to version 8.9.3 or later.

**Nome do software vulnerável e versões afetadas** Versões do SuiteCRM anteriores à 7.14.4 Versões do SuiteCRM anteriores à 8.6.1 **Descrição** Uma vulnerabilidade nos conectores do SuiteCRM permite que um usuário autenticado execute um ataque de execução remota de código. **Recomendações** Para versões anteriores à 7.14.4, atualize para a versão 7.14.4 ou posterior para resolver o problema. Para versões anteriores à 8.6.1, atualize para a versão 8.6.1 ou posterior para resolver o problema.