CVE-2024-36409: SuiteCRM authenticated SQL Injection in TreeData entrypoint
Published Jun 10, 2024
·Updated
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
Affected Software
2 affected components
SalesAgility SuiteCRM<7.14.4
SalesAgility SuiteCRM>=8.0.0<8.6.1
Event History
Jun 10, 2024
CVE Published
via MITRE·05:21 PM
Data Sourced
via MITRE·05:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-36409?
CVE-2024-36409 has a high severity rating due to the potential for SQL Injection attacks.
2
How do I fix CVE-2024-36409?
To fix CVE-2024-36409, upgrade to SuiteCRM version 7.14.4 or 8.6.1 or later.
3
What versions of SuiteCRM are affected by CVE-2024-36409?
Versions prior to 7.14.4 and 8.6.1 of SuiteCRM are vulnerable to CVE-2024-36409.
4
What type of attack does CVE-2024-36409 enable?
CVE-2024-36409 enables SQL Injection attacks through poor input validation.
5
Who is responsible for resolving issues related to CVE-2024-36409?
The responsibility for resolving issues related to CVE-2024-36409 falls on the users who need to update their SuiteCRM installations.