PT-2024-26973 · Php+1 · Php+1

Elsicarius · Published 2024-03-08 · Updated 2024-06-12 · CVE-2024-36407

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.14.4 SuiteCRM versions prior to 8.6.1

Description The issue allows an unauthenticated attacker to reset a user's password, although the attacker does not gain access to the new password. This can cause annoyance for the user. The attack requires certain password reset functionalities to be enabled and the system to be using PHP 7, which is not an officially supported version.

Recommendations For versions prior to 7.14.4, update to version 7.14.4 or later to resolve the issue. For versions prior to 8.6.1, update to version 8.6.1 or later to resolve the issue. As a temporary workaround, consider disabling password reset functionalities until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

BIT-SUITECRM-2024-36407

CVE-2024-36407

GHSA-6P2F-WWX9-952R

Affected Products

Php

Suitecrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36407.json · Exploit
• https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36407 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36407 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-suitecrm-2024-36407 · Vendor Advisory
• https://twitter.com/ksg93rd/status/1766132503604052442 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1800238394770923970 · Twitter Post
• https://twitter.com/CVEnew/status/1800209100141404504 · Twitter Post
• https://t.me/cybersecuritytechnologies/10110 · Telegram Post