« Volver al listado

CVE-2025-54785

Estado: AnalizadaAlta (8.8)—

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de deserialización PHP (CWE-20) requiere autenticación (PR:L) en servicio remoto. Permite ejecución arbitraria, escalada de privilegios y acceso a datos sensibles del CRM.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Salesagility — Suitecrm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-54785",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54785",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-07T14:48:18.923898Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "SuiteCRM",
          "product": "SuiteCRM",
          "versions": [
            {
              "status": "affected",
              "version": ">= 7.14.6, < 7.14.7"
            },
            {
              "status": "affected",
              "version": ">= 8.8.0, < 8.8.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-07T00:15:31.627",
  "references": [
    {
      "url": "https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-53cp-mpfw-qj67",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6  and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1."
    },
    {
      "lang": "es",
      "value": "SuiteCRM es una aplicación de software de gestión de relaciones con el cliente (CRM) de código abierto y lista para empresas. En las versiones 7.14.6 y 8.8.0, la información proporcionada por el usuario no se valida ni se desinfecta antes de pasarla a la función de deserialización, lo que podría provocar intrusiones, escalada de privilegios, exposición de datos confidenciales, denegación de servicio, criptominería y ransomware. Este problema se ha corregido en las versiones 7.14.7 y 8.8.1."
    }
  ],
  "lastModified": "2026-06-17T09:40:42.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:7.14.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4AF203E-EFE6-4DC2-8C36-041CB6AAFF44"
            },
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:8.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98D0BEC7-4738-47F4-9E25-9C89616886F4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}