CVE-2024-1644

Summary

Suite CRM version 7.14.2 allows including local php files. This is possible

because the application is vulnerable to LFI.

Affected Software

Weaknesses

• CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://github.com/salesagility/SuiteCRM/
• https://fluidattacks.com/advisories/silva/

References

• https://github.com/salesagility/SuiteCRM/
• https://fluidattacks.com/advisories/silva/

• ←Previous
• Next→