PT-2021-16884 · Suitecrm · Suitecrm

Published 2021-09-29 · Updated 2024-03-06 · CVE-2021-25960

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.10.29 through 7.10.31 SuiteCRM versions 7.11.18 through 7.11.19

Description The issue concerns a CSV Injection vulnerability, also known as Formula Injection, which allows a low-privileged attacker to inject payloads into input fields within the accounts module. When an administrator accesses this module to export data as a CSV file and opens it, the payload is executed. This vulnerability was not properly fixed as part of a previous security measure, enabling attackers to bypass security controls.

Recommendations For SuiteCRM versions 7.10.29 through 7.10.31, consider disabling the export functionality in the accounts module until a proper fix is available. For SuiteCRM versions 7.11.18 through 7.11.19, restrict access to the accounts module to minimize the risk of exploitation, especially when exporting data as CSV files.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BIT-SUITECRM-2021-25960

CVE-2021-25960

Affected Products

Suitecrm

References · 8

• https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648 · Patch
• https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513 · Patch
• https://osv.dev/vulnerability/BIT-suitecrm-2021-25960 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25960 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25960 · Vendor Advisory
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25960 · Note
• https://t.me/cvenotify/21635 · Telegram Post
• https://t.me/cibsecurity/29644 · Telegram Post