Cross-site Scripting (XSS) - Stored in salesagility/suitecrm
अनुवाद हो रहा है…प्लेटफ़ॉर्म
php
घटक
suitecrm
में ठीक किया गया
7.14.1
CVE-2023-5351 is a stored Cross-Site Scripting (XSS) vulnerability affecting SuiteCRM versions prior to 7.14.1. This vulnerability allows attackers to inject malicious scripts into the application, which are then executed in the browsers of unsuspecting users. Successful exploitation could lead to session hijacking, data theft, or defacement of the SuiteCRM instance. Affected versions include all releases up to and including 7.14.1; the vulnerability has been resolved in version 7.14.1.
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
The impact of CVE-2023-5351 is significant due to the nature of XSS vulnerabilities. An attacker could inject malicious JavaScript code into SuiteCRM, which would then be executed whenever a user views the affected page. This could allow the attacker to steal session cookies, effectively hijacking the user's account and gaining unauthorized access to sensitive data. Furthermore, the attacker could use the injected script to redirect users to phishing sites, display fake login forms, or modify the content of the page to mislead users. The blast radius extends to all users of the affected SuiteCRM instance, and the potential for widespread compromise is high, particularly if the system handles sensitive customer or financial data. The stored nature of the XSS means the malicious script persists until removed, potentially affecting numerous users over time.
शोषण संदर्भअनुवाद हो रहा है…
CVE-2023-5351 was published on October 3, 2023. While no active campaigns targeting this specific vulnerability have been publicly reported, the ease of exploitation associated with XSS vulnerabilities means it remains a potential target. The vulnerability is present in the GitHub repository salesagility/suitecrm, indicating it is publicly accessible. Severity is rated as High (CVSS 8.9) reflecting the potential for significant impact. No KEV or EPSS score is currently available.
खतरा खुफिया
एक्सप्लॉइट स्थिति
EPSS
0.13% (32% शतमक)
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- निम्न — कोई विशेष शर्त नहीं। विश्वसनीय रूप से शोषण योग्य।
- Privileges Required
- निम्न — कोई भी वैध उपयोगकर्ता खाता पर्याप्त है।
- User Interaction
- आवश्यक — पीड़ित को फ़ाइल खोलनी, लिंक पर क्लिक करना या पेज पर जाना होगा।
- Scope
- बदला हुआ — हमला कमज़ोर घटक से परे अन्य प्रणालियों तक फैल सकता है।
- Confidentiality
- उच्च — पूर्ण गोपनीयता हानि। हमलावर सभी डेटा पढ़ सकता है।
- Integrity
- उच्च — हमलावर कोई भी डेटा लिख, बदल या हटा सकता है।
- Availability
- निम्न — आंशिक या रुक-रुक कर सेवा से इनकार।
प्रभावित सॉफ्टवेयर
कमजोरी वर्गीकरण (CWE)
समयरेखा
- आरक्षित
- प्रकाशित
- संशोधित
- EPSS अद्यतन
शमन और वर्कअराउंडअनुवाद हो रहा है…
The primary mitigation for CVE-2023-5351 is to upgrade SuiteCRM to version 7.14.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Input validation and output encoding should be implemented on all user-supplied data to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of protection. Review and sanitize any custom code or plugins that interact with user input. After upgrading to 7.14.1, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into a form field and confirming that the script is not executed.
कैसे ठीक करेंअनुवाद हो रहा है…
Actualice SuiteCRM a la versión 7.14.1 o superior. Esta versión contiene una corrección para la vulnerabilidad XSS almacenada. La actualización se puede realizar a través del panel de administración de SuiteCRM o descargando la última versión del sitio web oficial y siguiendo las instrucciones de actualización.
CVE सुरक्षा न्यूज़लेटर
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2023-5351 — Cross-Site Scripting (XSS) in SuiteCRM?
It's a High severity Cross-Site Scripting (XSS) vulnerability in SuiteCRM versions up to 7.14.1, allowing attackers to inject malicious scripts.
Am I affected by CVE-2023-5351 in SuiteCRM?
If you are using SuiteCRM versions 7.14.1 or earlier, you are potentially affected by this vulnerability.
How do I fix CVE-2023-5351 in SuiteCRM?
Upgrade SuiteCRM to version 7.14.1 or later. Implement input validation and output encoding as a temporary measure.
Is CVE-2023-5351 being actively exploited?
No active campaigns have been publicly reported, but the vulnerability's ease of exploitation makes it a potential target.
Where can I find the official SuiteCRM advisory for CVE-2023-5351?
Refer to the official SuiteCRM security advisory and the NVD entry for CVE-2023-5351 for more details.
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।