medium6.1
CVE-2017-14510
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26).
Impact
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sugarcrm | Sugarcrm | through 7.7.2.2 Versions 6.5.26, 7.8.0.0, 7.8.0.1, 7.8.1.0, 7.8.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/
- https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/
- https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM