CVE-2023-6388

Suite CRM v7.14.2 - SSRF

State: Published
Severity: 5.0 Medium
Published: Feb 7, 2024
Updated: Sep 29, 2025
Reserved: Nov 29, 2023

Description

Suite CRM version 7.14.2 allows making arbitrary HTTP requests through

the vulnerable server. This is possible because the application is vulnerable

to SSRF.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N	Fluid Attacks

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Suite CRMSuite CRM	7.14.2Affected

References

https://fluidattacks.com/advisories/leon/third-party-advisory
https://github.com/salesagility/SuiteCRM/product
https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.