PT-2024-20584 · Espocrm · Espocrm

Kerkroups · Published 2024-02-29 · Updated 2025-06-27 · CVE-2024-24818

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 8.1.2

Description The issue allows an attacker to inject arbitrary IP or domain in the "Password Change" page, potentially redirecting the victim to a malicious page. This could lead to credential stealing or other attacks.

Recommendations For versions prior to 8.1.2, update to version 8.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the "Password Change" page until the update is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-610

CWE-601

Related Identifiers

BIT-ESPOCRM-2024-24818

CVE-2024-24818

GHSA-8GV6-8R33-FM7J

Affected Products

Espocrm

References · 8

• 🔥 https://github.com/espocrm/espocrm/security/advisories/GHSA-8gv6-8r33-fm7j · Exploit
• 🔥 https://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24818.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24818 · Security Note
• https://osv.dev/vulnerability/BIT-espocrm-2024-24818 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24818 · Vendor Advisory
• https://twitter.com/CVEnew/status/1763227083810000951 · Twitter Post
• https://t.me/cvenotify/126893 · Telegram Post