CVE-2023-47643: SuiteCRM has Unauthenticated Graphql Introspection Enabled

Published Nov 21, 2023

Updated

SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.

Affected Software

1 affected component

SalesAgility SuiteCRM=8.4.1

Remediation

Patch Available

https://github.com/salesagility/SuiteCRM-Core/commit/117dd8172793a239f71c91222606bf00677eeb33

Event History

Nov 21, 2023

CVE Published

07:32 PM

Data Sourced

07:32 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-47643?

CVE-2023-47643 is a vulnerability in SuiteCRM where Graphql Introspection is enabled without authentication.

What is SuiteCRM?

SuiteCRM is a Customer Relationship Management (CRM) software application.

What is the severity of CVE-2023-47643?

CVE-2023-47643 has a severity rating of 5.3 (medium).

How does CVE-2023-47643 affect SuiteCRM?

CVE-2023-47643 affects SuiteCRM version 8.4.1.

How can an attacker exploit CVE-2023-47643?

An attacker can exploit CVE-2023-47643 by obtaining the GraphQL schema and understanding the entire structure of the application.