CVE-2021-41597 - SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive

Back Back to CVE browser

HIGH

SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive

Published Jan 12, 2022

8.8

HIGH

CVSS 3.1

EPSS 1.03%

Description

SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (6)

https://docs.suitecrm.com/admin/releases/
x_refsource_MISCRelease Notes
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35
x_refsource_MISCRelease Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28611
Advisory
https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.md
x_refsource_MISCThird Party Advisory
https://github.com/salesagility/SuiteCRM
x_refsource_MISCProduct
https://suitecrm.com
x_refsource_MISCProduct

Link	Providers	Tags
https://docs.suitecrm.com/admin/releases/		x_refsource_MISCRelease Notes
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35		x_refsource_MISCRelease Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28611		Advisory
https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.md		x_refsource_MISCThird Party Advisory
https://github.com/salesagility/SuiteCRM		x_refsource_MISCProduct
https://suitecrm.com		x_refsource_MISCProduct