PT-2019-10254 · Salesagility · Suitecrm

Leap-Nishit · Published 2019-04-05 · Updated 2021-07-22 · CVE-2018-20816

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SalesAgility SuiteCRM versions 7.x through 7.8.23 SalesAgility SuiteCRM versions 7.10.x through 7.10.10

Description: The issue is related to a combination of XSS and CSRF vulnerabilities. It affects the "add dashboard pages" feature, allowing malicious attacks through phished URLs, which can lead to script execution and cookie stealing, also known as session hijacking.

Recommendations: For SalesAgility SuiteCRM versions 7.x through 7.8.23, update to version 7.8.24 or later. For SalesAgility SuiteCRM versions 7.10.x through 7.10.10, update to version 7.10.11 or later.

Fix

CSRF

XSS

Weakness Enumeration

CWE-352

CWE-79

Related Identifiers

CVE-2018-20816

Affected Products

Suitecrm

References · 6

• https://github.com/salesagility/SuiteDocs/pull/198/files · Patch
• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20816 · Vendor Advisory
• https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20816 · Security Note
• https://t.me/cvenotify/18010 · Telegram Post