Security features bypass in EspoCRM - CVE-2024-24818
Published: March 18, 2024
Vulnerability identifier: #VU87582
CSH Severity: Medium
CVSS v4: 5.8 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-24818
CWE-ID: CWE-254
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to weakness in "Forgot password". A remote attacker on the local network can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack.
Affected software
EspoCRM
How to mitigate CVE-2024-24818
Install updates from vendor's website.
EspoCRM - update to 8.1.2