CVE-2024-24818

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-610 CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-248198.8icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is CVE-2024-24823.7A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerabilit CVE-2024-248208.3Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to ma CVE-2024-248217.8Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included du CVE-2024-248229.1Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. ta CVE-2024-248234.4Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with CVE-2024-248248.8Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can CVE-2024-248257.5DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. Th CVE-2024-248265.0Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds CVE-2024-248277.5Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an CVE-2024-248287.8pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded direct CVE-2024-248295.3Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to inter