PT-2025-45365 · Suitecrm · Suitecrm

Exodus Intelligence · Published 2022-03-02 · Updated 2025-11-24 · CVE-2022-50590

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.12.6

Description SuiteCRM contains a type confusion issue in the processing of the module parameter within the deleteAttachment functionality. Successful exploitation could allow remote, unauthenticated attackers to alter database objects, including the ability to change the administrator's email address. The issue involves accessing a resource through incompatible types when handling the module parameter.

Recommendations Update to version 7.12.6 or later.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2025-13972

CVE-2022-50590

Affected Products

Suitecrm

References · 7

• https://osv.dev/vulnerability/CVE-2022-50590 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13972 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50590 · Security Note
• https://t.me/cveNotify/143858 · Telegram Post
• https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability · Note
• https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6 · Patch, Vendor Advisory
• https://vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionality · Note