CVE-2024-36416

HIGH

SuiteCRM v4 API Excessive log data DOS

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-36416 has a selected CVSS score of 8.6 (high); EIP currently links 1 repository PoC.

Description

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 11, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SuiteCRM

Browse salesagility / SuiteCRM

Default status: affected

CVE List< 7.14.4affected
>= 8.0.0, < 8.6.1affected
7.0.0 to < 7.14.4affected
8.0.0 to < 8.6.1affected

Proofs of concept

1

Repository PoCs

GitHubkva55/CVE-2024-36416Repository PoCby kva550Not analyzed3 files

9.2 KiB

GitHub
PoC details

References

3