CVE-2021-41596

medium

Description

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.

References

Advisories
More

https://github.com/salesagility/SuiteCRM

https://github.com/ach-ing/cves/blob/main/CVE-2021-41596.md

https://suitecrm.com

https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22

https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33

Details

Source: Mitre, NVD

Published: 2021-10-04

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N