PT-2022-24593 · Espocrm · Espocrm

Published 2022-09-16 · Updated 2024-03-06 · CVE-2022-38843

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EspoCRM version 7.1.8

Description The issue allows attackers to upload malicious files with any extension to the server. These malicious files can be executed to run unintended code on the server, potentially compromising it.

Recommendations For EspoCRM version 7.1.8, update to a version that fixes the Unrestricted File Upload issue to prevent attackers from uploading malicious files. As a temporary workaround, consider restricting file uploads to only necessary extensions and validating all uploaded files to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BIT-ESPOCRM-2022-38843

CVE-2022-38843

Affected Products

Espocrm

References · 6

• 🔥 https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-unrestricted-file-upload-7860b15d12bc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38843 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38843 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-espocrm-2022-38843 · Vendor Advisory
• https://t.me/cibsecurity/49911 · Telegram Post
• https://t.me/cvenotify/36334 · Telegram Post