CVE-2024-36416
Salesagility Suitecrm ≤ 7.14.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2024-36416 is a high-severity Logging of Excessive Data (CWE-779) vulnerability in Salesagility Suitecrm. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 22% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AU-2 (Event Logging) and AU-7 (Audit Record Reduction and Report Generation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
SuiteCRM, an open-source customer relationship management application, contains a denial-of-service vulnerability in a deprecated v4 API example that lacks log rotation. The flaw, present in versions prior to 7.14.4 and 8.6.1, permits excessive data to be written to logs, resulting in resource exhaustion. The issue is tracked as CVE-2024-36416 with a CVSS 3.1 score of 8.6 and is associated with CWE-779.
An unauthenticated attacker with network access can trigger the vulnerability by sending crafted requests to the affected API endpoint, causing unbounded log growth that leads to service disruption. No user interaction or credentials are required, and the attack impacts availability while leaving confidentiality and integrity intact.
Official advisories from the SuiteCRM project and the corresponding GitHub security advisory recommend immediate upgrade to versions 7.14.4 or 8.6.1, which contain the fix. Public references also include release notes and a proof-of-concept repository that illustrate the logging behavior.
The EPSS score for this CVE stands at 0.4470 with no material increase from a lower baseline after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36073
Vulnerability Data
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a fix…
more
for this issue.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Defining the exact event types to be logged prevents indiscriminate collection of excessive data.
Audit-record reduction and on-demand reporting directly reduce the impact of overly verbose logs during review.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Excessive logging hinders log processing and forensic analysis, largely undermining DE.AE-04's ability to estimate impact/scope via SIEMs or tools while removing most of that outcome's efficacy.
Excessive logging undermines event analysis by flooding logs with noise that hinders processing and forensic review, but does not blind or defeat the outcome the way insufficient logging would.
Excessive logging impairs processing of provided event data and log-analysis findings (one aspect of DE.AE-06) without fully defeating alert/ticket distribution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.15 directly requires logging to be configured so that only necessary events are recorded, preventing excessive data.
Documented operating procedures can include logging guidelines, indirectly reducing excessive logging.
Monitoring activities can detect excessive logging but do not prescribe how much data should be logged.