CVE-2021-41597: CSRF
Published Jan 12, 2022
·Updated
SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.
Affected Software
2 affected components
SalesAgility SuiteCRM>=7.10.0<7.10.35
SalesAgility SuiteCRM>=7.12<7.12.2
Event History
Jan 12, 2022
CVE Published
via MITRE·07:17 PM
Data Sourced
via MITRE·07:17 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this SuiteCRM vulnerability?
The vulnerability ID for this SuiteCRM vulnerability is CVE-2021-41597.
2
What is the severity of CVE-2021-41597?
The severity of CVE-2021-41597 is high.
3
What is the affected software for CVE-2021-41597?
The affected software for CVE-2021-41597 is SuiteCRM versions 7.10.0 to 7.10.35 and 7.12.0 to 7.12.2.
4
How can CVE-2021-41597 be exploited?
CVE-2021-41597 can be exploited through CSRF, leading to remote code execution via the UpgradeWizard functionality if a PHP file is included in a ZIP archive.
5
What is the official reference for CVE-2021-41597?
The official reference for CVE-2021-41597 can be found at https://docs.suitecrm.com/admin/releases/ and https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.md.