CVE-2022-38844: High severity espocrm vulnerability
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-38844?
CVE-2022-38844 is a vulnerability in EspoCRM 7.1.8 that allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands.
How does CVE-2022-38844 affect EspoCRM 7.1.8?
CVE-2022-38844 allows remote authenticated users to run system commands on the system by creating contacts with payloads that can execute system commands.
What is the severity of CVE-2022-38844?
CVE-2022-38844 has a severity rating of high (8 out of 10).
How can I mitigate the vulnerability CVE-2022-38844 in EspoCRM 7.1.8?
To mitigate CVE-2022-38844, it is recommended to update EspoCRM to a version that is not affected by this vulnerability, if available. Additionally, it is important to sanitize user-generated content and implement input validation and filtering to prevent CSV injection.
Where can I find more information about CVE-2022-38844?
More information about CVE-2022-38844 can be found at the following reference: [link](https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-csv-injection-4c07494e2a76).