CVE-2024-36407

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.14.4 SuiteCRM versions prior to 8.6.1

Description The issue allows an unauthenticated attacker to reset a user's password, although the attacker does not gain access to the new password. This can cause annoyance for the user. The attack requires certain password reset functionalities to be enabled and the system to be using PHP 7, which is not an officially supported version.

Recommendations For versions prior to 7.14.4, update to version 7.14.4 or later to resolve the issue. For versions prior to 8.6.1, update to version 8.6.1 or later to resolve the issue. As a temporary workaround, consider disabling password reset functionalities until a patch is available.