CVE-2024-36415: SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36415?
CVE-2024-36415 has been assigned a high severity rating due to its potential for remote code execution.
How do I fix CVE-2024-36415?
To fix CVE-2024-36415, upgrade SuiteCRM to version 7.14.4 or 8.6.1 or later.
What versions of SuiteCRM are affected by CVE-2024-36415?
CVE-2024-36415 affects SuiteCRM versions prior to 7.14.4 and between 8.0.0 and 8.6.0.
What kind of vulnerability is CVE-2024-36415?
CVE-2024-36415 is a vulnerability related to inadequate verification of uploaded files, leading to remote code execution.
Is there a workaround for CVE-2024-36415?
There are no official workarounds for CVE-2024-36415; updating to a fixed version is the recommended approach.