Unscored CVE-2021-41596 EUVD-2021-28610GHSA-4jcj-f5hc-phm8

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary file…

Published Oct 4, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.

References

https://suitecrm.com
https://github.com/salesagility/SuiteCRM
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33
https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22
https://github.com/ach-ing/cves/blob/main/CVE-2021-41596.md