CVE-2024-24818CWE-610
EspoCRM weakness in "Forgot password"
Medium · published February 29, 2024
What it is
EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.
The record
Technical detail
- CVSS v3.1
- 5.9 · MEDIUM
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00615 · 48.8th percentile
- Weakness
- CWE-610 · Externally Controlled Reference to a Resource in Another Sphere
- Published
- 2024-02-29T15:17Z
EPSS history
Timeline