high8.8
CVE-2017-14509
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26).
Impact
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sugarcrm | Sugarcrm | through 7.7.2.2 Versions 6.5.26, 7.8.0.0, 7.8.0.1, 7.8.1.0, 7.8.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/
- https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/
- https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM