CVE-2021-45041

Опубликовано: 19 дек. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Средний

Описание

SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_date.

Ссылки

https://docs.suitecrm.com/8.x/admin/releases/8.0/
Patch
Release Notes
Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.12.x/
Patch
Release Notes
Vendor Advisory
https://github.com/manuelz120/CVE-2021-45041
Exploit
Third Party Advisory
https://docs.suitecrm.com/8.x/admin/releases/8.0/
Patch
Release Notes
Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.12.x/
Patch
Release Notes
Vendor Advisory
https://github.com/manuelz120/CVE-2021-45041
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*

Версия до 7.12.2 (исключая)

cpe:2.3:a:salesagility:suitecrm:8.0:beta:*:*:*:*:*:*

cpe:2.3:a:salesagility:suitecrm:8.0:beta2:*:*:*:*:*:*

cpe:2.3:a:salesagility:suitecrm:8.0:beta3:*:*:*:*:*:*

cpe:2.3:a:salesagility:suitecrm:8.0:rc:*:*:*:*:*:*

cpe:2.3:a:salesagility:suitecrm:8.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.13282

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-qgv7-c9x8-v89f

github

около 4 лет назад

SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection.