SuiteCRM LDAP Injection Vulnerability in Authentication Flow

A vulnerability allowing LDAP injection has been identified in SuiteCRM versions prior to 7.15.1 and 8.9.3. This issue arises because the application does not adequately sanitize user input before incorporating it into the LDAP search filter. As a result, an unauthenticated attacker could inject LDAP control characters to manipulate the query logic, potentially leading to authentication bypass or unauthorized information disclosure.

Impact

Exploitation of this vulnerability could result in authentication bypass or unauthorized information disclosure.

Remediation

Users can upgrade to SuiteCRM versions 7.15.1 or 8.9.3 to address this vulnerability.