Security readout for executives and security teams
Plain-English summary
SuiteCRM 7.14.2 has a server-side request forgery flaw that can let an authenticated attacker make the server send arbitrary HTTP requests. That may let the attacker interact with systems reachable from the SuiteCRM server, depending on network placement. Public sources do not support active exploitation.
Executive priority
Treat this as a moderate-priority remediation for any SuiteCRM 7.14.2 deployment. The issue is not listed as known exploited, but SSRF can become business-relevant when CRM servers can reach sensitive internal services. Prioritize internet-facing or broadly accessible instances first.
Technical view
CVE-2023-6388 is CWE-918 SSRF in SuiteCRM 7.14.2. The CVSS 3.1 score is 5.0 with network access, low complexity, low privileges, no user interaction, changed scope, and low integrity impact. The source bundle identifies SuiteCRM 7.14.4 release documentation as the patch reference.
Likely exposure
Exposure is limited to organizations running SuiteCRM 7.14.2, especially internet-accessible or partner-accessible instances where authenticated users can reach the vulnerable functionality. The source bundle marks other versions as unaffected by default but does not enumerate broader version ranges.
Exploitation context
The CVE states arbitrary HTTP requests can be made through the vulnerable server. KEV is false, and the provided sources do not claim exploitation in the wild or provide public exploit status. Practical impact depends on what internal or cloud resources the SuiteCRM server can reach.
Researcher notes
The public bundle confirms affected version 7.14.2, CWE-918, CVSS 5.0, and a 7.14.4 patch reference. It does not provide detailed vulnerable endpoint information, exploit maturity, or observed attacks. Avoid assuming data disclosure unless additional evidence shows reachable sensitive targets.
Mitigation direction
- Inventory SuiteCRM deployments and identify any instance running version 7.14.2.
- Review SuiteCRM 7.14.4 release guidance and apply the vendor-supported update path.
- Check the Fluid Attacks advisory for any vendor-specific remediation notes.
- Monitor SuiteCRM project updates for additional security guidance or affected-version clarification.
Validation and detection
- Confirm the deployed SuiteCRM version from application or package records.
- Verify upgraded systems are no longer running SuiteCRM 7.14.2.
- Review application logs for unexpected outbound HTTP requests from SuiteCRM servers.
- Assess what internal services the SuiteCRM server can reach from its network segment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-6388 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N3.11.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://fluidattacks.com/advisories/leon/CVE reference · third-party-advisory
- https://github.com/salesagility/SuiteCRM/CVE reference · product
- https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.