{"id":"CVE-2020-28328","aliases":["BIT-suitecrm-2020-28328","EUVD-2020-20791","GHSA-4c2c-97pg-w9x9"],"status":"published","title":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File...","description":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.63267,"percentile":0.99217,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-434","CWE-74"],"published":"2020-11-06T18:18:05Z","modified":"2026-10-24T10:30:59Z","exploits":[{"source":"pocgithub","id":"mcorybillington/SuiteCRM-RCE","title":"mcorybillington/SuiteCRM-RCE","date":"2020-11-06","url":"https://github.com/mcorybillington/SuiteCRM-RCE"},{"source":"exploitdb","id":"EDB-49001","title":"SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated)","type":"webapps","platform":"php","date":"2020-11-09","url":"https://www.exploit-db.com/exploits/49001"},{"source":"metasploit","id":"exploit/linux/http/suitecrm_log_file_rce","title":"SuiteCRM Log File Remote Code Execution","type":"exploit","platform":"Linux,Unix","date":"2021-04-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/suitecrm_log_file_rce"}],"fixes":[{"ecosystem":"Bitnami","package":"suitecrm","fixed_in":["7.11.17"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"suitecrm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.11.17"}]}]}],"products":[{"vendor":"salesagility","product":"suitecrm"}],"references":[{"url":"https://suitecrm.com/suitecrm-7-11-17-7-10-28-lts-versions-released/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","web","advisory"]},{"url":"https://github.com/mcorybillington/SuiteCRM-RCE","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","evidence"]},{"url":"http://packetstormsecurity.com/files/159937/SuiteCRM-7.11.15-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web","evidence"]},{"url":"http://packetstormsecurity.com/files/162975/SuiteCRM-Log-File-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web","evidence"]},{"url":"http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28328","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4c2c-97pg-w9x9"}],"sources":{"cve":[{"id":"CVE-2020-28328","description":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.","status":"published","published":"2020-11-06T18:18:05Z","modified":"2024-08-04T16:33:59.067Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-20791","description":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.","status":"published","published":"2020-11-06T18:18:05Z","modified":"2024-08-04T16:33:59Z","updated_at":"2026-11-03T03:07:10.123634Z"}],"ghsa":[{"id":"GHSA-4c2c-97pg-w9x9","title":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File...","description":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.","status":"published","published":"2022-05-24T17:33:20Z","modified":"2023-01-29T05:04:37Z","cwes":["CWE-74","CWE-434"],"updated_at":"2026-11-02T14:45:36.114986Z"}],"nvd":[{"id":"CVE-2020-28328","description":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.","status":"published","published":"2020-11-06T19:15:14.143Z","modified":"2026-06-17T03:10:17.31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"CVE-2020-28328","description":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.","status":"published","published":"2020-11-06T19:15:14.143Z","modified":"2026-10-24T10:30:59.179036434Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"BIT-suitecrm-2020-28328","description":"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.","status":"published","published":"2024-03-06T11:11:11.767Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}