1. Home
  2. CVE Database
  3. CVE-2024-24818
MEDIUM · 5.9

CVE-2024-24818

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to c...

Vulnerability Description

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
EspocrmEspocrm< 8.1.2

Related Weaknesses (CWE)

CWE-601CWE-610

References

FAQ

What is CVE-2024-24818?

CVE-2024-24818 is a vulnerability with a CVSS score of 5.9 (MEDIUM). EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to c...

How severe is CVE-2024-24818?

CVE-2024-24818 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-24818?

Check the references section above for vendor advisories and patch information. Affected products include: Espocrm Espocrm.