HIGH
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3
Published Jun 17, 2023
8.8
HIGHCVSS 3.1
EPSS 1.26%
Description
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.
Affected products
No data.
OR
- ≥ 11.0.0 · < 11.0.6
- ≥ 11.0.0 · < 11.0.6
- ≥ 11.0.0 · < 11.0.6
- ≥ 11.0.0 · < 11.0.6
- ≥ 11.0.0 · < 11.0.6
- ≥ 12.0.0 · < 12.0.3
- ≥ 12.0.0 · < 12.0.3
- ≥ 12.0.0 · < 12.0.3
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- http://packetstormsecurity.com/files/174301/SugarCRM-12.2.0-Bean-Manipulation.html
- http://seclists.org/fulldisclosure/2023/Aug/27 mailing-list
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39804 Advisory
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-007/ Vendor Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 17, 2023
Updated Dec 17, 2024
Reserved Jun 17, 2023
Link CVE-2023-35809
CISA Vulnrichment
Updated Dec 17, 2024
ENISA EUVD
EUVD-2023-39804 Assigner mitre
Published Jun 17, 2023
Updated Dec 17, 2024
Exploited since n/a
Link EUVD-2023-39804