PT-2022-24594 · Espocrm · Espocrm

Published 2022-09-16 · Updated 2024-03-06 · CVE-2022-38844

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EsppoCRM version 7.1.8

Description The issue allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. An admin user exporting contacts in a CSV file may end up executing the malicious system commands on their system.

Recommendations For EspoCRM version 7.1.8, update to a version that includes a fix for this issue, as using the current version may allow malicious system commands to be executed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BIT-ESPOCRM-2022-38844

CVE-2022-38844

Affected Products

Espocrm

References · 6

• 🔥 https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-csv-injection-4c07494e2a76 · Exploit
• https://osv.dev/vulnerability/CVE-2022-38844 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-espocrm-2022-38844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38844 · Security Note
• https://t.me/cibsecurity/49917 · Telegram Post
• https://t.me/cvenotify/36333 · Telegram Post