Read the docs
TI-2024-33241 Aliases CVE-2024-49774

ModuleScanner flaws in SuiteCRM

Priority LOW 34CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses token_get_all to parse PHP scripts and check the resulted AST against blacklists. But it doesn't take into account all scenarios. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00502 43rd percentileScored 2026-11-07
Fix Fixed SuiteCRM (salesagility): 7.14.6, 8.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
salesagilitySuiteCRMbefore 7.14.6; 8.0.0 to before 8.7.17.14.6, 8.7.1Patch availableCNA
  • SuiteCRM Vendorsalesagility Affected before 7.14.6; 8.0.0 to before 8.7.1 Fixed in 7.14.6, 8.7.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*before 7.14.6; 8.0.0 to before 8.7.1Vulnerablesalesagility
  • cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:* Versions before 7.14.6; 8.0.0 to before 8.7.1 Vulnerable ·salesagility

Remediation

  • Fix · CNA SuiteCRM (salesagility) Fixed in 7.14.6, 8.7.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-49774

References

Advisory 1

  • TI-2023-05636 Code Injection in salesagility/suitecrm CVSS 3.1HIGH 8.8
  • TI-2023-03386 Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core CVSS 3.1HIGH 8.8
  • TI-2022-22252 An issue was discovered in SuiteCRM 7.12.7. CVSS 3.1HIGH 8.8
  • TI-2020-17178 SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings… CVSS 3.1HIGH 8.8
  • TI-2023-04923 SQL Injection in salesagility/suitecrm CVSS 3.1CRITICAL 9.1
  • TI-2021-19004 SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File… CVSS 3.1HIGH 8.8
See all 104 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences