EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges.
| Źródło | Link | Uwagi |
|---|---|---|
| NVD (NIST) | https://nvd.nist.gov/vuln/detail/CVE-2020-37094 | Karta CVE w NVD |
| CISA KEV | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-37094 | Wyszukiwanie CVE w KEV |
| FIRST EPSS | https://api.first.org/data/v1/epss?cve=CVE-2020-37094 | API EPSS dla CVE |
| disclosure@vulncheck.com | https://www.espocrm.com | Product |
| disclosure@vulncheck.com | https://www.exploit-db.com/exploits/48376 | Exploit, VDB Entry |
| disclosure@vulncheck.com | https://www.vulncheck.com/advisories/espocrm-privilege-escalation | Third Party Advisory |