Login Request a demo
Medium severity · published Dec 5, 2023
CVE-2023-46736
EspoCRM is an Open Source CRM (Customer Relationship Management) software
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via the upload image from url api. Users who have access to `the /Attachment/fromImageUrl` endpoint can specify URL to point to an internal host. Even though there is check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information (in some cases), target internal hosts and bypass firewalls. This vulnerability has been addressed in commit `c536cee63` which is included in release version 8.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Espocrm · Espocrm
through 8.0.2 · source: NVD
Affected product
ES
Espocrm
Espocrm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46736
Patch
https://github.com/espocrm/espocrm/commit/c536cee6375e2088f961af13db7aaa652c983072
Vendor Advisory
https://github.com/espocrm/espocrm/security/advisories/GHSA-g955-rwxx-jvf6
Third Party Advisory
https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
More from Espocrm
9.1
CVE-2026-47168
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
9.1
CVE-2026-33656
EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user
8.8
CVE-2022-38843
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server
8.8
CVE-2019-14351
EspoCRM 5.6.4 is vulnerable to user password hash enumeration
8.5
CVE-2025-32390
EspoCRM is a free, open-source customer relationship management platform