Medium
Security advisory
An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-20816
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:33 UTC · Revision 1
Source evidence
An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.
osv:CVE-2018-20816
Complete source record
{
"id": "dcda0023ee9ac6afb558d83c14d5656fcd8f64268ca80a4f4e6caf1374837aa4",
"url": "https://osv.dev/vulnerability/CVE-2018-20816",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-20816",
"summary": "An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the \"add dashboard pages\" feature where users can receive a malicious attack through a phished URL, with script executed.",
"evidence": "osv:CVE-2018-20816",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-20816",
"aliases": [
"CVE-2018-20816"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/SuiteCRM/SuiteCRM",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "501445cafabb91dc498305c5e19ab9ec558a12bd"
},
{
"fixed": "2479923a1a71f45143ef8614c7899df11574fbb9"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.8.24"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.00"
},
{
"fixed": "7.10.11"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v7.8.23",
"v7.10.10",
"v7.8.22",
"v7.8.21",
"v7.8.20",
"v7.10.5",
"v7.10.7",
"v7.10.4",
"v7.10.6",
"v7.8.19",
"v7.10.1",
"v7.8.18",
"v7.10.3",
"v7.8.17",
"v7.10.2",
"v7.8.16",
"v7.8.15",
"v7.10.0",
"v7.9.14",
"v7.9.13",
"v7.8.14",
"v7.8.12",
"v7.9.12",
"v7.9.11",
"v.7.9.11",
"v7.9.10",
"v7.8.11",
"v7.9.8",
"v7.8.9",
"v7.9.4",
"7.9.6",
"v7.9.5",
"v7.8.5",
"v7.9.3",
"v7.9.1",
"v7.9.0",
"v7.8.4",
"v7.8.3",
"v7.9.0-rc",
"v7.9.0-beta",
"v7.8.2",
"v7.8.1",
"v7.8.0",
"v7.8.0-rc",
"v7.8.0-beta.2",
"v7.8.0-beta",
"v7.7.4",
"v7.7.3",
"v7.7.2",
"v7.7",
"v7.7-rc2",
"v7.7-rc",
"v7.7-beta2",
"v7.7-beta1",
"v7.6.1",
"v7.6",
"v7.5.1",
"v7.5-beta.2",
"v7.4.3",
"v7.5-beta",
"v7.4.1",
"v7.4.2",
"v7.3.2",
"v7.3.1",
"v7.3",
"v7.3-beta",
"v7.2",
"v7.2.1",
"v7.1.3",
"v7.2beta2",
"v7.1.4",
"v7.2beta",
"v7.1.2",
"v7.1.1",
"v7.1",
"v7.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20816.json"
}
}
],
"modified": "2026-10-24T10:30:30.268936530Z",
"provider": "osv",
"references": [
"https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11",
"https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24",
"https://github.com/salesagility/SuiteDocs/pull/198/files"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"
],
"vendor_product": "salesagility:suitecrm",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.8.24"
},
{
"introduced": "7.10.00"
},
{
"fixed": "7.10.11"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-20816",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432540,
"published_at": "2019-04-05T16:29:00.24+00:00"
}