Vulnerability Description
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Salesagility | Suitecrm | < 7.14.4 |
Related Weaknesses (CWE)
References
- https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952rVendor Advisory
- https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952rVendor Advisory
FAQ
What is CVE-2024-36407?
CVE-2024-36407 is a vulnerability with a CVSS score of 3.7 (LOW). SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attack...
How severe is CVE-2024-36407?
CVE-2024-36407 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-36407?
Check the references section above for vendor advisories and patch information. Affected products include: Salesagility Suitecrm.