| Package | Affected versions | Patched versions |
|---|---|---|
| suitecrm | ≥ 7.14.0, < 7.14.7≥ 8.6.0, < 8.8.1 | 7.14.78.8.1 |
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared message to the inbox of the SuiteCRM-instance. By simply viewing emails as the logged-in user, the payload can be triggered. With that, an attacker is able to run arbitrary actions as the logged-in user - like extracting data, or if it is an admin executing the payload, takeover the instance. This is fixed in versions 7.14.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free