CVE-2021-41595

2021-10-0416:46:08

mitre

www.cve.org

suitecrm

information disclosure

directory traversal

step3 import functionality

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

44.5%

JSON

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.

References

docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33

docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22

github.com/ach-ing/cves/blob/main/CVE-2021-41595.md

github.com/salesagility/SuiteCRM