CVE-2024-50333: RCE in ModuleBuilder in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels() function can be used to write attacker-controlled data into the custom language file that will be included at the runtime. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50333?
CVE-2024-50333 has been assigned a high severity rating due to the potential for user input exploitation and filesystem manipulation.
How do I fix CVE-2024-50333?
To mitigate CVE-2024-50333, ensure input validation is implemented in the ParserLabel::addLabels() function and update to SuiteCRM version 8.7.1 or later.
What versions of SuiteCRM are affected by CVE-2024-50333?
CVE-2024-50333 affects SuiteCRM versions prior to 7.14.6 and versions between 8.0.0 and 8.7.1.
What kind of attack can be executed using CVE-2024-50333?
CVE-2024-50333 allows an attacker to write arbitrary data to the filesystem, potentially leading to file inclusion or data theft.
Is there a patch available for CVE-2024-50333?
Yes, updating SuiteCRM to version 8.7.1 or higher addresses the vulnerability associated with CVE-2024-50333.