SuiteCRM up to 7.10.34/7.12.1 ZIP Archive UpgradeWizard cross-site request forgery

EntryeditHistoryDiffjsonxmlCTI

A vulnerability was found in SuiteCRM up to 7.10.34/7.12.1. It has been classified as problematic. Affected is the function UpgradeWizard of the component ZIP Archive Handler. Upgrading to version 7.10.35 or 7.12.2 eliminates this vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	22
0	18

Field

source_cve_nvd_summary	1
exploit_price_0day	1
vulnerability_cvss3_meta_tempscore	1
vulnerability_cvss3_meta_basescore	1
vulnerability_cvss3_vuldb_tempscore	1

Commit Conf

90%	29
50%	10
70%	1

Approve Conf

90%	29
80%	10
70%	1

ID	Commited	User	Field	Change	Remarks	Accepted	Reason	C
12050170	01/15/2022	VulD...	cve_nvd_summary	SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.	cve.mitre.org	01/15/2022	accepted	70
12037784	01/13/2022	VulD...	price_0day	$0-$5k	see exploit price documentation	01/13/2022	accepted	90
12037783	01/13/2022	VulD...	cvss3_meta_tempscore	4.1	see CVSS documentation	01/13/2022	accepted	90
12037782	01/13/2022	VulD...	cvss3_meta_basescore	4.3	see CVSS documentation	01/13/2022	accepted	90
12037781	01/13/2022	VulD...	cvss3_vuldb_tempscore	4.1	see CVSS documentation	01/13/2022	accepted	90
12037780	01/13/2022	VulD...	cvss3_vuldb_basescore	4.3	see CVSS documentation	01/13/2022	accepted	90
12037779	01/13/2022	VulD...	cvss2_vuldb_tempscore	4.4	see CVSS documentation	01/13/2022	accepted	90
12037778	01/13/2022	VulD...	cvss2_vuldb_basescore	5.0	see CVSS documentation	01/13/2022	accepted	90
12037777	01/13/2022	VulD...	cvss3_vuldb_e	X	derived from historical data	01/13/2022	accepted	80
12037776	01/13/2022	VulD...	cvss2_vuldb_e	ND	derived from historical data	01/13/2022	accepted	80
12037775	01/13/2022	VulD...	cvss2_vuldb_rl	OF	derived from vuldb v3 vector	01/13/2022	accepted	80
12037774	01/13/2022	VulD...	cvss2_vuldb_rc	C	derived from vuldb v3 vector	01/13/2022	accepted	80
12037773	01/13/2022	VulD...	cvss2_vuldb_ai	N	derived from vuldb v3 vector	01/13/2022	accepted	80
12037772	01/13/2022	VulD...	cvss2_vuldb_ii	P	derived from vuldb v3 vector	01/13/2022	accepted	80
12037771	01/13/2022	VulD...	cvss2_vuldb_ci	N	derived from vuldb v3 vector	01/13/2022	accepted	80
12037770	01/13/2022	VulD...	cvss2_vuldb_au	N	derived from vuldb v3 vector	01/13/2022	accepted	80
12037769	01/13/2022	VulD...	cvss2_vuldb_ac	L	derived from vuldb v3 vector	01/13/2022	accepted	80
12037768	01/13/2022	VulD...	cvss2_vuldb_av	N	derived from vuldb v3 vector	01/13/2022	accepted	80
12037767	01/13/2022	VulD...	date	1642028400 (01/13/2022)		01/13/2022	accepted	90
12037766	01/13/2022	VulD...	cve_assigned	1632434400	cve.org	01/13/2022	accepted	90

20 more entries are not shown

🔒 Login Required

You need to signup and login to see more of the remaining 20 results.

◂ Previous Overview Next ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!