CVE-2024-50332 — Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM

CVE-2024-50332

Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM PUBLISHED

Description (CNA)

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (CNA)

Vendor / product	Versions
salesagility / SuiteCRM	affected < 7.14.6; affected >= 8.0.0, < 8.7.1

CWE

CWE-89

References

https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-53xh-mjmq-j35p

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.