CVE-2024-36416

SuiteCRM v4 API Excessive log data DOS

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Affected

salesagility · SuiteCRM

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 GITHUB

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS

1.95% chance of exploitation in the next 30 days, 80th percentile

Published

2024-06-10

Updated

2025-02-13

Proof-of-concept exploits (1)

• kva55/CVE-2024-364160★ · 2024-06-15

Security advisories

• salesagility/SuiteCRM/security/advisories/GHSA-jrpp-22g3-2j77

References

• CVE Record
• NVD entry