CVE-2024-36411: SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller
Published Jun 10, 2024
·Updated
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax displayView controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
Affected Software
2 affected components
SalesAgility SuiteCRM<7.14.4
SalesAgility SuiteCRM>=8.0.0<8.6.1
Event History
Jun 10, 2024
CVE Published
via MITRE·07:33 PM
Data Sourced
via MITRE·07:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-36411?
CVE-2024-36411 has been categorized as a critical vulnerability due to the potential for SQL Injection.
2
Which versions of SuiteCRM are affected by CVE-2024-36411?
CVE-2024-36411 affects SuiteCRM versions prior to 7.14.4 and 8.6.1.
3
How do I fix CVE-2024-36411?
To fix CVE-2024-36411, upgrade SuiteCRM to version 7.14.4 or 8.6.1 or later.
4
What kind of vulnerability is CVE-2024-36411?
CVE-2024-36411 is an input validation vulnerability that allows for SQL Injection attacks.
5
What impact does CVE-2024-36411 have on data security?
CVE-2024-36411 can potentially allow attackers to manipulate the database and access sensitive information.