high8.8Known exploited
CVE-2023-22952
Multiple SugarCRM Products Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-02-02. Federal due date: 2023-02-23.
Apply updates per vendor instructions.
Impact
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sugarcrm | Sugarcrm | from 11.0.0 before 11.0.5 from 12.0.0 before 12.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/
- http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22952