CVE-2023-5351: XSS in SuiteCRM ≤7.14.1

The impact of CVE-2023-5351 is significant due to the nature of XSS vulnerabilities. An attacker could inject malicious JavaScript code into SuiteCRM, which would then be executed whenever a user views the affected page. This could allow the attacker to steal session cookies, effectively hijacking the user's account and gaining unauthorized access to sensitive data. Furthermore, the attacker could use the injected script to redirect users to phishing sites, display fake login forms, or modify the content of the page to mislead users. The blast radius extends to all users of the affected SuiteCRM instance, and the potential for widespread compromise is high, particularly if the system handles sensitive customer or financial data. The stored nature of the XSS means the malicious script persists until removed, potentially affecting numerous users over time.

1. Reserved2023-10-03
2. Published2023-10-03
3. Modified2024-09-19
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5351 is to upgrade SuiteCRM to version 7.14.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Input validation and output encoding should be implemented on all user-supplied data to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of protection. Review and sanitize any custom code or plugins that interact with user input. After upgrading to 7.14.1, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into a form field and confirming that the script is not executed.