CVE-2024-24818

MEDIUM EPSS 45.0%
Published Mar 21, 20242y ago · Modified Jun 17, 20262w ago
5.9 CVSS 3.1
Medium
Find Similar
Published Mar 21, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

CVSS Details

Base Score
5.9
Exploitability
1.2
Impact
4.7
Vector string
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Attack Vector Adjacent
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
45.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-601
CWE-610

Affected Products 1

VendorProductVersionRange
espocrmespocrm* <8.1.2

References 2

  • github.com https://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7
    Patch
  • github.com https://github.com/espocrm/espocrm/security/advisories/GHSA-8gv6-8r33-fm7j
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7
    Patch