Executive Summary

This vulnerability exists in SuiteCRM, an open-source Customer Relationship Management software. Before versions 7.15.1 and 8.9.3, the WebToLead capture functionality contains an unauthenticated open redirect flaw. Specifically, a user-supplied POST parameter is used as a redirect destination without proper validation.

This means attackers can craft requests that cause SuiteCRM to redirect users to arbitrary external websites, potentially malicious ones.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to abuse the trusted SuiteCRM domain to redirect users to malicious external websites. This can be used for phishing and social engineering attacks, tricking users into revealing sensitive information or downloading malware.

Because the redirect is unauthenticated and uses user-supplied input without validation, it can be exploited by anyone to target SuiteCRM users or visitors.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade SuiteCRM to version 7.15.1 or 8.9.3 or later, as these versions contain patches that fix the unauthenticated open redirect issue in the WebToLead capture functionality.

Useful 0 Not Useful 0