CVE-2024-24818

MEDIUM5.9EPSS 0.13%

Published: 3/31/2024Modified: 10/15/2025

Also known as:GHSA-8gv6-8r33-fm7jBIT-espocrm-2024-24818

Description

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

Affected packages (1)

Bitnami/espocrmfrom 0, < 8.1.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.9	CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

References (2)

WEBhttps://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7
WEBhttps://github.com/espocrm/espocrm/security/advisories/GHSA-8gv6-8r33-fm7j