PT-2022-11437 · Suitecrm · Suitecrm

Konstantin Damotsev + 1 · Published 2022-01-12 · Updated 2024-03-06 · CVE-2021-41597

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.11.21 and earlier

Description The issue allows for remote code execution via the UpgradeWizard functionality if a PHP file is included in a ZIP archive. This is made possible by a CSRF vulnerability.

Recommendations For versions 7.11.21 and earlier, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the UpgradeWizard functionality until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-SUITECRM-2021-41597

CVE-2021-41597

Affected Products

Suitecrm

References · 9

• 🔥 https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41597 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41597 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-suitecrm-2021-41597 · Vendor Advisory
• https://github.com/salesagility/SuiteCRM · Note
• https://suitecrm.com · Note
• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35 · Note
• https://t.me/cvenotify/25336 · Telegram Post
• https://docs.suitecrm.com/admin/releases · Note