CVE-2021-25961
published 2021-09-29CVE-2021-25961: In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a…
PriorityP338high8CVSS 3.1
AVNACLPRLUIRSUCHIHAH
EPSS
0.92%
55.8th percentile
In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| salesagility | suitecrm | >= 7.1.7 < 7.10.32 | 7.10.32 |
| salesagility | suitecrm | >= 7.11.0 < 7.11.21 | 7.11.21 |
| salesagility | suitecrm | >= v7.1.7 < * | * |
| salesagility | suitecrm | >= v7.11 < v7.11.21 | v7.11.21 |
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25961https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25961
2021-09-29
Published