CVE-2025-32789
Low
Description
EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of the sorted list of users. Although unlikely, if an attacker knows the hash value of their password, they can change the password and repeat the sorting until the other user's password hash is fully revealed. This issue is patched in version 9.0.7.
SeverityLow
CVSS3.1
Exploit probability—
Product
Espocrm
PublishedApr 16, 2025
First seenApr 16, 2025
Weakness typeCWE-200Sensitive information exposureCWE-203CWE-203
How to fix
Update
- espocrm espocrm9.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| espocrm espocrm | v < 9.0.7 | 9.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.