PT-2025-30320 · Espocrm · Espocrm

Yotizj13 · Published 2025-07-21 · Updated 2025-08-05 · CVE-2025-52575

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions EspoCRM versions 9.1.6 and earlier

Description EspoCRM is an Open Source CRM (Customer Relationship Management) software. Versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration.

Recommendations Update to version 9.1.7 or later.

Exploit

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2025-52575

GHSA-RJM8-77FR-4F3V

Affected Products

Espocrm

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52575.json · Exploit
• 🔥 https://github.com/espocrm/espocrm/security/advisories/GHSA-rjm8-77fr-4f3v · Exploit
• 🔥 https://github.com/espocrm/espocrm/commit/8649f1ac0ce714b2c31727bca3dd95d06e17337f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-52575 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52575 · Vendor Advisory
• https://twitter.com/CVEnew/status/1947361904046870890 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1947369058296320304 · Twitter Post
• https://t.me/cveNotify/130966 · Telegram Post