CVSS 3.1 Score 7.2 of 10 (high)


Published Nov 30, 2023
Updated: Dec 6, 2023
CWE ID 434


CVE-2023-5965 is a cyber vulnerability that affects the EspoCRM server in version 7.2.5. An authenticated privileged attacker can exploit this vulnerability by uploading a specially crafted zip file via the update form, potentially leading to arbitrary PHP code execution. This vulnerability has a base severity of HIGH with a base score of 7.2 according to the National Vulnerability Database (NVD). It requires high privileges and has no user interaction requirement. The attack vector is through the network, and it poses a high risk to integrity, confidentiality, and availability of the affected system. Organizations using EspoCRM version 7.2.5 should take immediate action to remediate this vulnerability by applying necessary patches or updates provided by the vendor to prevent potential exploitation and mitigate any potential damage that can be caused by arbitrary code execution.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-5965 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options