CVE-2024-24818

CVSS V2 None CVSS V3 None

Description

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

Overview

CVE ID
CVE-2024-24818

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-02-29T15:17:16.859Z

Last Modified Date
2024-02-29T15:17:16.859Z

Weakness Enumerations

CWE	URL
CWE-610	http://cwe.mitre.org/data/definitions/610.html

References

Reference URL	Reference Tags
https://github.com/espocrm/espocrm/security/advisories/GHSA-8gv6-8r33-fm7j	x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-24818
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24818

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 04:14:00				Added to TrackCVE