CVE-2023-47643 LOW

CVE-2023-47643: SuiteCRM has Unauthenticated Graphql Introspection Enabled

Vendor Salesagility
Product SuiteCRM-Core
Weakness CWE-200 · Info exposure
Published November 21, 2023
Last update November 27, 2024
View on NVD All CVEs

CVSS base score

3.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.

Key dates

02Disclosure timeline

November 21, 2023 CVE published
November 27, 2024 Record updated