CVE-2024-36415
SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
8.8
HIGH
CVSS 3.1
EPSS 0.88%
描述
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
如何修補 CVE-2024-36415
要修補 CVE-2024-36415,請將受影響套件升級到下列已修補版本。
- —升級至 7.14.4 或更新版本
CVE-2024-36415 正在被利用嗎?
低 — EPSS 為 0.9%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 7.14.4, >= 8.0.0, < 8.6.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |