Salesagility: >> Suitecrm >> 7.11.12 Security Vulnerabilities
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.
CVSS Score
6.1
EPSS Score
0.003
Published
2020-11-18
SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation.
CVSS Score
7.8
EPSS Score
0.003
Published
2020-11-18
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.
CVSS Score
8.8
EPSS Score
0.527
Published
2020-11-06
Page 6