CVE-2018-20816

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2019-04-05

Last modified

2024-08-05

Weaknesses

CWE-352, CWE-79

Affected products

• Suitecrm (Salesagility)

References

• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11
• https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24
• https://github.com/salesagility/SuiteDocs/pull/198/files