CVE-2024-36406

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36406
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-hcw8-p37h-8hrv Vendor Advisory
https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-hcw8-p37h-8hrv Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*
cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*
History

12 Aug 2025, 20:20

Type Values Removed Values Added
CPE cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*
First Time Salesagility
Salesagility suitecrm
References () https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-hcw8-p37h-8hrv - () https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-hcw8-p37h-8hrv - Vendor Advisory
Information

Published : 2024-06-10 15:15

Updated : 2025-08-12 20:20

NVD link : CVE-2024-36406

Mitre link : CVE-2024-36406

CVE.ORG link : CVE-2024-36406

JSON object : View

Products Affected

salesagility

  • suitecrm
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')