PT-2021-16885 · Suitecrm · Suitecrm

Published 2021-09-29 · Updated 2024-03-06 · CVE-2021-25961

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.1.7 through 7.10.31 SuiteCRM versions 7.11-beta through 7.11.20

Description The issue arises from the failure to properly invalidate password reset links associated with a deleted user id, making it possible for account takeover of any newly created user with the same user id.

Recommendations For versions 7.1.7 through 7.10.31, consider temporarily restricting the use of password reset links until a patch is available. For versions 7.11-beta through 7.11.20, consider temporarily restricting the use of password reset links until a patch is available. As a temporary workaround, consider disabling the password reset functionality for deleted user ids to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

BIT-SUITECRM-2021-25961

CVE-2021-25961

Affected Products

Suitecrm

References · 8

• https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648 · Patch
• https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25961 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25961 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-suitecrm-2021-25961 · Vendor Advisory
• https://t.me/cvenotify/21634 · Telegram Post
• https://t.me/cibsecurity/29643 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25961 · Note