CVE-2021-41595: Path Traversal
Published Oct 4, 2021
·Updated
SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the filename parameter of the Step3 import functionality.
Affected Software
2 affected components
SalesAgility SuiteCRM<7.10.33
SalesAgility SuiteCRM>=7.11.0<7.11.22
Event History
Oct 4, 2021
CVE Published
via MITRE·04:46 PM
Data Sourced
via MITRE·04:46 PM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2021-41595?
CVE-2021-41595 is a vulnerability in SuiteCRM before version 7.10.33 and 7.11.22 that allows information disclosure through Directory Traversal.
2
How does CVE-2021-41595 work?
CVE-2021-41595 allows an attacker to partially include arbitrary files by manipulating the 'file_name' parameter of the Step3 import functionality.
3
What is the severity of CVE-2021-41595?
CVE-2021-41595 has a severity rating of 5.3, which is considered medium.
4
Which versions of SuiteCRM are affected by CVE-2021-41595?
SuiteCRM versions before 7.10.33 and 7.11.22 are affected by CVE-2021-41595.
5
How can I fix CVE-2021-41595 in SuiteCRM?
To fix CVE-2021-41595, you should update SuiteCRM to version 7.10.33 or 7.11.22.