PT-2026-26431 · Suitecrm · Suitecrm

Rvizx · Publicado 2026-03-19 · Atualizado 2026-03-20 · CVE-2026-29097

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RSS Feed Dashlet component. A Server-Side Request Forgery (SSRF) occurs when an application allows an attacker to make requests to unintended locations. This can be used to access internal resources or perform actions on behalf of the server. A Denial of Service (DoS) condition occurs when a system is made unavailable to legitimate users.

Recommendations Update SuiteCRM to version 7.15.1 or later. Update SuiteCRM to version 8.9.3 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-29097

GHSA-X3P2-QCQH-QX2M

Produtos afetados

Suitecrm

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29097.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-x3p2-qcqh-qx2m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-29097 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034841521196081167 · Publicação no Twitter
• https://docs.suitecrm.com/admin/releases/7.15.x · Nota
• https://twitter.com/infoflowcloud/status/2034842813943205935 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29097 · Nota de Segurança