CVE-2024-24818

EspoCRM weakness in "Forgot password"

State: Published
Severity: 5.9 Medium
Published: Feb 29, 2024
Updated: Aug 5, 2024
Reserved: Jan 31, 2024

Description

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L	GitHub_M

Weaknesses

CWE-610 Externally Controlled Reference to a Resource in Another Sphere

Affected Products

Product	Versions
espocrmespocrm	< 8.1.2Affected

References

https://github.com/espocrm/espocrm/security/advisories/GHSA-8gv6-8r33-fm7j
https://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.