CVE-2018-20816

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-05 · updated 2026-06-17
Weakness: CWE-79

Description

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.

Affected products

salesagility SuiteCRM: from 7.0.0 before 7.8.24; from 7.10.00 before 7.10.11 — fixed in 7.10.11, 7.8.24

How to fix

Upgrade to a fixed version: salesagility SuiteCRM 7.10.11, 7.8.24. Check the vendor advisory for mitigations.

References

https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11
https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24
https://github.com/salesagility/SuiteDocs/pull/198/files
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11
https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24
https://github.com/salesagility/SuiteDocs/pull/198/files

Get alerted when CVE-2018-20816 or the next vulnerability affects your stack