PT-2019-10254 · Salesagility · Suitecrm

Leap-Nishit · Publicado 2019-04-05 · Atualizado 2021-07-22 · CVE-2018-20816

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SalesAgility SuiteCRM versions 7.x through 7.8.23 SalesAgility SuiteCRM versions 7.10.x through 7.10.10

Description: The issue is related to a combination of XSS and CSRF vulnerabilities. It affects the "add dashboard pages" feature, allowing malicious attacks through phished URLs, which can lead to script execution and cookie stealing, also known as session hijacking.

Recommendations: For SalesAgility SuiteCRM versions 7.x through 7.8.23, update to version 7.8.24 or later. For SalesAgility SuiteCRM versions 7.10.x through 7.10.10, update to version 7.10.11 or later.

Correção

CSRF

XSS

Enumeração de Fraquezas

CWE-352

CWE-79

Identificadores relacionados

CVE-2018-20816

Produtos afetados

Suitecrm

Referências · 6

• https://github.com/salesagility/SuiteDocs/pull/198/files · Correção
• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-20816 · Aviso do Fabricante
• https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24 · Aviso do Fabricante
• https://t.me/cvenotify/18010 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-20816 · Nota de Segurança