Critical
SuiteCRM authenticated SQL Injection in TreeData entrypoint
Type: advisorySources: OSV
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-36409
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 22:49 UTC · Revision 1
Source evidence
SuiteCRM authenticated SQL Injection in TreeData entrypoint
core-osv · Original sourcePublished 10 Jun 2024, 17:21 UTC
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
osv:CVE-2024-36409
Complete source record
{
"id": "880baffe27621ae606b7fd37585ee0fe8bc3ed7b1173727f815ea62c620e7124",
"url": "https://osv.dev/vulnerability/CVE-2024-36409",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "SuiteCRM authenticated SQL Injection in TreeData entrypoint",
"summary": "SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.",
"evidence": "osv:CVE-2024-36409",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2024-36409",
"aliases": [
"BIT-suitecrm-2024-36409",
"CVE-2024-36409",
"GHSA-pxq4-vw23-v73f"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/SuiteCRM/SuiteCRM",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "504d6f0ebd5847169d73c52d312e91916a7280bb"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "7.14.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.14.4"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/SuiteCRM/SuiteCRM-Core",
"type": "GIT",
"events": [
{
"introduced": "55c1ee9cbdf409ed41c04da0bbf442b311a3ab57"
},
{
"fixed": "f483bec4cffb267840725af5c022a7e8f2599934"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v7.14.3",
"v7.14.2",
"v7.14.1",
"v7.14.0",
"v7.14.0-beta",
"v7.13.4",
"v7.13.3",
"v7.13.2",
"v7.13.1",
"v7.13.0",
"v7.12.8",
"v7.13.0-beta",
"v7.12.7",
"v7.12.6",
"v7.12.5",
"v7.12.4",
"v7.12.3",
"v7.12.2",
"v7.12.1",
"v7.12.0",
"v7.12-rc",
"v7.11.18",
"v7.11.17",
"v7.11.16",
"v7.11.15",
"v7.11.14",
"v7.11.13",
"v7.11.12",
"v7.11.11",
"v7.11.8",
"v7.11.7",
"v7.11.6",
"v7.11.5",
"v7.11.4",
"v7.11.3",
"v7.11.2",
"v7.10.12",
"v7.11.1",
"v7.11.0",
"v7.10.11",
"v7.10.10",
"v7.10.5",
"v7.10.7",
"v7.10.4",
"v7.10.6",
"v7.10.1",
"v7.10.3",
"v7.10.2",
"v7.10.0",
"v7.9.14",
"v7.9.13",
"v7.9.12",
"v7.9.11",
"v.7.9.11",
"v7.9.10",
"v7.9.8",
"v7.9.4",
"7.9.6",
"v7.9.5",
"v7.9.3",
"v7.9.1",
"v7.9.0",
"v7.9.0-rc",
"v7.9.0-beta",
"v7.8.2",
"v7.8.1",
"v7.8.0",
"v7.8.0-rc",
"v7.8.0-beta.2",
"v7.8.0-beta",
"v7.7.4",
"v7.7.3",
"v7.7.2",
"v7.7",
"v7.7-rc2",
"v7.7-rc",
"v7.7-beta2",
"v7.7-beta1",
"v7.6.1",
"v7.6",
"v7.5.1",
"v7.5-beta.2",
"v7.4.3",
"v7.5-beta",
"v7.4.1",
"v7.4.2",
"v7.3.2",
"v7.3.1",
"v7.3",
"v7.3-beta",
"v7.2",
"v7.2.1",
"v7.1.3",
"v7.2beta2",
"v7.1.4",
"v7.2beta",
"v7.1.2",
"v7.1.1",
"v7.1",
"v7.0.2",
"v8.6.0",
"v8.5.1",
"v8.5.0",
"v8.4.2",
"v8.4.1",
"v8.4.0",
"v8.4.0-beta",
"v8.3.1",
"v8.3.0",
"v8.2.4",
"v8.2.3",
"v8.2.2",
"v8.2.1",
"v8.2.0",
"v8.2.0-beta.2",
"v8.1.3",
"v8.1.2",
"v8.1.1",
"v8.1.0",
"v8.0.4",
"v8.0.3",
"v8.0.2",
"v8.0.1",
"v8.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36409.json"
}
}
],
"modified": "2026-10-28T02:30:31.923536191Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36409.json",
"https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f",
"https://nvd.nist.gov/vuln/detail/CVE-2024-36409"
],
"provider_metadata": {
"cwe_ids": [
"CWE-89"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36409.json"
}
},
"related_cves": [
{
"value": "CVE-2024-36409",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499181,
"published_at": "2024-06-10T17:21:27.796+00:00"
}