CVE-2024-36410: SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller
Published Jun 10, 2024
·Updated
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
Affected Software
2 affected components
SalesAgility SuiteCRM<7.14.4
SalesAgility SuiteCRM>=8.0.0<8.6.1
Event History
Jun 10, 2024
CVE Published
via MITRE·05:24 PM
Data Sourced
via MITRE·05:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-36410?
CVE-2024-36410 is classified as a high severity vulnerability due to the potential for SQL Injection attacks.
2
How do I fix CVE-2024-36410?
To fix CVE-2024-36410, upgrade SuiteCRM to version 7.14.4 or 8.6.1 or later.
3
What versions of SuiteCRM are affected by CVE-2024-36410?
CVE-2024-36410 affects SuiteCRM versions prior to 7.14.4 and versions between 8.0.0 and 8.6.0.
4
What are the potential impacts of CVE-2024-36410?
Exploitation of CVE-2024-36410 can lead to unauthorized data access and manipulation through SQL Injection.
5
Is there a known exploit for CVE-2024-36410?
As of now, there are no publicly known exploits specifically targeting CVE-2024-36410.