BIT-suitecrm-2021-41596

vendorUSosv

view advisory published 2024-03-06Licence: per source

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41596US	medium5.3	1.83% (79th)	—	2021-10-04
SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the Ref…

references

External citations — patches, advisories, analysis.

https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33WEB
https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22WEB
https://github.com/ach-ing/cves/blob/main/CVE-2021-41596.mdWEB
https://github.com/salesagility/SuiteCRMWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-41596WEB
https://suitecrm.comWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan