Suitecrm CVE-2021-41596

MEDIUM

Path Traversal (CWE-22)

2021-10-04 cve@mitre.org

Path Traversal Information Disclosure Suitecrm

5.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Oct 04, 2021 - 17:15 nvd

MEDIUM 5.3

DescriptionNVD

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.

AnalysisAI

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality. Affected products include: Salesagility Suitecrm. Version information: before 7.10.33.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Suitecrm

View all

CVE-2021-42840 HIGH Act Now POC

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. Rated high severity

CVE-2020-28328 HIGH Act Now POC

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. Rated high

CVE-2024-36412 CRITICAL Act Now POC

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Rated critical severity (CVSS 9.

CVE-2023-6126 CRITICAL Act Now POC

Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated critical severity (CVSS

CVE-2023-5350 CRITICAL Act Now POC

SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1. Rated critical severity (CVSS 9.1), this vulne

CVE-2015-5947 HIGH This Week POC

SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. Rated high severity (CVSS 8.1), this vulnerabil

CVE-2022-45185 HIGH This Week POC

An issue was discovered in SuiteCRM 7.12.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

CVE-2024-1644 HIGH This Week POC

Suite CRM version 7.14.2 allows including local php files. Rated high severity (CVSS 8.8), this vulnerability is remotel

CVE-2023-6131 HIGH This Week POC

Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated high severity (CVSS 8.8

CVE-2023-6130 HIGH This Week POC

Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated high se

CVE-2023-6125 HIGH This Week POC

Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated high severity (CVSS 8.8

CVE-2023-3627 HIGH This Week POC

Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1. Rated high severity (C

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

CVE-2019-19781 CRITICAL POC

CVE-2020-5902 CRITICAL POC

CVE-2021-40444 HIGH POC

CVE-2021-27065 HIGH POC

CVE-2019-11510 CRITICAL POC

CVE-2018-13379 CRITICAL POC

CVE-2015-0016 HIGH POC

Same technique Path Traversal

View all

CVE-2025-64446 CRITICAL POC

CVE-2015-0016 HIGH POC

CVE-2016-0752 HIGH POC

CVE-2024-13159 CRITICAL POC

CVE-2024-13160 CRITICAL POC

CVE-2024-13161 CRITICAL POC

CVE-2014-0780 CRITICAL POC

CVE-2024-48248 HIGH POC

Share

CVE-2021-41596 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy