CVE-2023-47643 SuiteCRM has Unauthenticated Graphql Introspection Enabled
Unauthenticated GraphQL introspection in SuiteCRM exposes the API schema and sensitive fields, allowing attackers to map the attack surface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-47643?
CVE-2023-47643 is a low-severity vulnerability in Salesagility Suitecrm, published on 21 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.
Weakness: CWE-200
Which versions are affected by CVE-2023-47643?
1 open source package ship an affected version, including suitecrm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
suitecrm Bitnami | From 8.4.1 | 8.4.2 |
Products include Salesagility Suitecrm.
How do I fix CVE-2023-47643?
Upgrade suitecrm to 8.4.2 or later.
Is CVE-2023-47643 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47643 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Salesagility Suitecrm
Sources
Also known as BIT-suitecrm-2023-47643, GHSA-fxww-jqfv-9rrr.