CVE-2022-50590: SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality
SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.12.6
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50590?
CVE-2022-50590 is classified as a high-severity vulnerability due to its potential for remote unauthenticated exploitation.
How do I fix CVE-2022-50590?
To fix CVE-2022-50590, upgrade SuiteCRM to version 7.12.6 or later.
What types of attacks are possible with CVE-2022-50590?
Exploitation of CVE-2022-50590 can allow attackers to alter database objects and potentially change email content.
Which versions of SuiteCRM are affected by CVE-2022-50590?
CVE-2022-50590 affects SuiteCRM versions prior to 7.12.6.
Is authentication required to exploit CVE-2022-50590?
No, CVE-2022-50590 can be exploited by remote unauthenticated attackers.