CVE-2020-8786: SQL Injection

Q: What is CVE-2020-8786?

CVE-2020-8786 refers to a SQL Injection vulnerability in SuiteCRM versions 7.10.x prior to 7.10.23 and 7.11.x prior to 7.11.11.

Q: How severe is CVE-2020-8786?

CVE-2020-8786 has a severity rating of 9.8 (Critical).

Q: Which versions of SuiteCRM are affected by CVE-2020-8786?

SuiteCRM versions 7.10.x prior to 7.10.23 and 7.11.x prior to 7.11.11 are affected by CVE-2020-8786.

Q: What is the Common Weakness Enumeration (CWE) ID for CVE-2020-8786?

CVE-2020-8786 is associated with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).

Q: How can I fix CVE-2020-8786?

To fix CVE-2020-8786, ensure that you upgrade SuiteCRM to version 7.10.23 or 7.11.11 respectively.

Published Mar 16, 2020

Updated

SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).

Affected Software

2 affected components

SalesAgility SuiteCRM>=7.10.0<7.10.23

SalesAgility SuiteCRM>=7.11.0<7.11.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SuiteCRM to a version that resolves this vulnerability.
Fixed in 7.10.23
Upgrade
Upgrade SuiteCRM to a version that resolves this vulnerability.
Fixed in 7.11.11

Event History

Mar 16, 2020

CVE Published

via MITRE·09:35 PM

Data Sourced

via MITRE·09:35 PM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-8786?

CVE-2020-8786 refers to a SQL Injection vulnerability in SuiteCRM versions 7.10.x prior to 7.10.23 and 7.11.x prior to 7.11.11.

How severe is CVE-2020-8786?