PT-2020-13934 · Salesagility · Suitecrm

Luis Noriega · Published 2020-11-18 · Updated 2024-03-06 · CVE-2020-14208

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM version 7.11.13

Description The issue is related to stored Cross-Site Scripting (XSS) in the Documents preview functionality. This could allow remote authenticated attackers to inject arbitrary web script or HTML.

Recommendations For SuiteCRM version 7.11.13, consider disabling the Documents preview functionality until a patch is available to prevent exploitation. Restrict access to the Documents module to minimize the risk of arbitrary web script or HTML injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-SUITECRM-2020-14208

CVE-2020-14208

Affected Products

Suitecrm

References · 8

• https://osv.dev/vulnerability/CVE-2020-14208 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-suitecrm-2020-14208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14208 · Security Note
• https://t.me/cvenotify/5803 · Telegram Post
• https://t.me/cibsecurity/16565 · Telegram Post
• https://t.me/cvenotify/5961 · Telegram Post
• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-008 · Note
• https://t.me/cibsecurity/17399 · Telegram Post