« Volver al listado

CVE-2021-45899

Estado: ModificadaCrítica (9.8)—

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Salesagility — Suitecrm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-45899",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-28T17:15:15.177",
  "references": [
    {
      "url": "https://docs.suitecrm.com/8.x/admin/releases/8.0/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://docs.suitecrm.com/admin/releases/7.12.x/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://docs.suitecrm.com/8.x/admin/releases/8.0/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.suitecrm.com/admin/releases/7.12.x/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution."
    },
    {
      "lang": "es",
      "value": "SuiteCRM versiones anteriores a 7.12.3 y 8.x versiones anteriores a 8.0.2, permite una deserialización de PHAR que puede conllevar a una ejecución de código remota"
    }
  ],
  "lastModified": "2026-06-17T04:14:13.173",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "102933B6-5C87-4773-8823-A4A06C0CCB21",
              "versionEndExcluding": "7.12.3"
            },
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DB0A339-6755-4345-96C0-26312AAA6462",
              "versionEndExcluding": "8.0.2",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:8.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68FDB6E1-3674-477F-B29E-33A0270F542B"
            },
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:8.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F2501E9-69F2-4A71-A8BF-92C73EB8ECFA"
            },
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:8.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "466A60B8-6287-48B1-951F-83A0D0AEE642"
            },
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:8.0:rc:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3701D6A-977E-4883-932C-327CB333D086"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}