CVE-2024-36407: SuiteCRM unauthenticated user password reset on php7
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36407?
The severity of CVE-2024-36407 is considered moderate due to the potential for user annoyance and impact on account security.
How do I fix CVE-2024-36407?
To fix CVE-2024-36407, upgrade SuiteCRM to version 7.14.4 or 8.6.1 or later.
What versions of SuiteCRM are impacted by CVE-2024-36407?
CVE-2024-36407 affects SuiteCRM versions prior to 7.14.4 and between 8.0.0 and 8.6.1.
Can an attacker gain access to user accounts through CVE-2024-36407?
No, the attacker cannot gain access to user accounts as they do not receive the new password.
What kind of attack does CVE-2024-36407 describe?
CVE-2024-36407 describes an unauthenticated password reset vulnerability.