CVE-2021-41597

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.suitecrm.com/admin/releases/Release Notes
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35Release Notes
https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.mdThird Party Advisory
https://github.com/salesagility/SuiteCRMProduct
https://suitecrm.comProduct
https://docs.suitecrm.com/admin/releases/Release Notes
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35Release Notes
https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.mdThird Party Advisory
https://github.com/salesagility/SuiteCRMProduct
https://suitecrm.comProduct

Timeline

Published: Jan 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415988.8A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub CVE-2021-415998.8A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. CVE-2021-41605.9There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 CVE-2021-416087.5A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthentica CVE-2021-416099.8SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenti CVE-2021-41617.5The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. CVE-2021-416117.5An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly CVE-2021-416128.8An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract ins CVE-2021-416134.3An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EE CVE-2021-416147.8An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program CVE-2021-416159.8websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinpara CVE-2021-416169.8Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY,