CVE-2024-36419

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
salesagility	SuiteCRM-Core	< 8.6.1
salesagility	suitecrm	< 8.6.1

References

https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-3323-hjq3-c6vcThird Party Advisory
https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-3323-hjq3-c6vcThird Party Advisory

Timeline

Published: Jun 10, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-36426.9The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make log CVE-2024-364207.5Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-as CVE-2024-364217.5Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguratio CVE-2024-364226.1Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site CVE-2024-364236.1Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site CVE-2024-364245.5K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer deref CVE-2024-364267.5In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.CVE-2024-364278.1The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to CVE-2024-364288.1OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.CVE-2024-36438.8The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in CVE-2024-364327.5An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS CVE-2024-364337.5An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware befor