CVE-2022-45186

CVE-2022-45186 is a vulnerability discovered in SuiteCRM version 7.12.7 that allows authenticated users to recover an arbitrary field from the database. This flaw affects the open-source customer relationship management software SuiteCRM, specifically the 7.12.7 release, enabling unauthorized access to sensitive database content beyond the user's privileges.

The vulnerability can be exploited over the network with low complexity by users with low privileges, such as any authenticated account, requiring no user interaction. Successful exploitation grants high-impact confidentiality by allowing recovery of arbitrary database fields and high-impact integrity by potentially enabling unauthorized modifications, with no impact on availability, as reflected in its CVSS v3.1 base score of 8.1.

Mitigation details are available in the SuiteCRM 7.12.x release documentation, which covers patches and updates for affected versions. Additional resources include the Orange Cyberdefense CVE repository and a corresponding proof-of-concept script demonstrating the issue.