CVE-2024-36407

SuiteCRM unauthenticated user password reset on php7

State: Published
Severity: 3.7 Low
Published: Jun 10, 2024
Updated: Aug 2, 2024
Reserved: May 27, 2024

Description

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Scores

CVSS	Score	Vector	Source
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Affected Products

Product	Versions
SuiteCRMsalesagility	< 7.14.4Affected >= 8.0.0, < 8.6.1Affected

References

https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952r

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.