Description
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId, campaignId, and templateId to reattach marketing messages or swap the template EmailMan sends in campaign emails.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SuiteCRM SuiteCRM
Default version status: unaffected
0 to ≤ 7.15.2affected8.0.0 to ≤ 8.10.2affected
pkg:github/SuiteCRM/SuiteCRMReferences
- https://hackmd.io/@haind03/suitecrm-campaign-wizard-emailmarketing-missing-authorization ↗
- https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/modules/Campaigns/WizardCampaignSave.php#L88-L122 ↗
- https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/include/MVC/Controller/entry_point_registry.php#L93 ↗
- https://github.com/SuiteCRM/SuiteCRM-Core/blob/v8.10.2/public/legacy/modules/Campaigns/WizardCampaignSave.php#L88-L113 ↗
- https://github.com/SuiteCRM/SuiteCRM ↗
- https://www.vulncheck.com/advisories/suitecrm-through-7.15.2-and-8.10.2-missing-authorization-via-setcampaignmarketingandtemplate ↗