PT-2023-32535 · Suitecrm · Suitecrm

Published 2023-11-14 · Updated 2024-03-06 · CVE-2023-6130

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.12.14 SuiteCRM versions prior to 7.14.2 SuiteCRM versions prior to 8.4.2

Description The issue concerns a path traversal vulnerability, where the sequence '..filename' can be used to access files outside the intended directory. This could potentially allow unauthorized access to sensitive information.

Recommendations For versions prior to 7.12.14, update to version 7.12.14 or later. For versions prior to 7.14.2, update to version 7.14.2 or later. For versions prior to 8.4.2, update to version 8.4.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-29

Related Identifiers

BIT-SUITECRM-2023-6130

CVE-2023-6130

Affected Products

Suitecrm

References · 6

• 🔥 https://huntr.com/bounties/22a27be9-f016-4daf-9887-c77eb3e1dc74 · Exploit
• https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9 · Patch
• https://osv.dev/vulnerability/BIT-suitecrm-2023-6130 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6130 · Security Note
• https://twitter.com/CVEnew/status/1724465032820621485 · Twitter Post