CVE-2024-36408: SuiteCRM authenticated SQL Injection in Alerts
Published Jun 10, 2024
·Updated
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in the Alerts controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
Affected Software
2 affected components
SalesAgility SuiteCRM<7.14.4
SalesAgility SuiteCRM>=8.0.0<8.6.1
Event History
Jun 10, 2024
CVE Published
via MITRE·04:46 PM
Data Sourced
via MITRE·04:46 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-36408?
CVE-2024-36408 is considered a high severity vulnerability due to its potential for SQL Injection.
2
How do I fix CVE-2024-36408?
To fix CVE-2024-36408, upgrade SuiteCRM to version 7.14.4 or 8.6.1 or later.
3
What versions are affected by CVE-2024-36408?
CVE-2024-36408 affects SuiteCRM versions prior to 7.14.4 and versions between 8.0.0 and 8.6.1.
4
What type of vulnerability is CVE-2024-36408?
CVE-2024-36408 is classified as an SQL Injection vulnerability.
5
Where can I find more information about CVE-2024-36408?
Detailed information about CVE-2024-36408 can be found in the SuiteCRM security advisories.