CVE-2021-25961 SuiteCRM - Account Takeover in Password Reset Functionality
Attackers can take over accounts of newly created users by exploiting password reset links associated with deleted user IDs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-25961?
CVE-2021-25961 is a high-severity vulnerability in Salesagility Suitecrm, published on 29 Sep 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.
Weakness: CWE-640
Which versions are affected by CVE-2021-25961?
1 open source package ship an affected version, including suitecrm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
suitecrm Bitnami | From 7.1.7 | 7.10.32, 7.11.21 |
Products include Salesagility Suitecrm.
How do I fix CVE-2021-25961?
Upgrade suitecrm to a fixed version for your release line: 7.10.32 or 7.11.21.
Is CVE-2021-25961 being exploited?
There is no known exploitation of CVE-2021-25961 in the wild and no public exploit code.
Other vulnerabilities in Salesagility Suitecrm
Sources
Also known as BIT-suitecrm-2021-25961, GHSA-qgww-6vq6-rm44.