CVE-2021-42840

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting

published October 22, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
59%
Percentile
99.1
In the wild
Unconfirmed
What it is

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.58597 · 99.1th percentile
Published
2021-10-22T18:20Z
EPSS history
Timeline
  • 22 OCT 18:20Z
    SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting
    cvelistv5