CVE-2015-5946

Published: Aug 7, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.

Affected (1)

Products: Sugarcrm: Sugarcrm

Sugarcrm

1 product

Sugarcrm

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sugarcrm Sugarcrm	Version 6.5.22

Related CWEs

CWE-184

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (6)

http://www.openwall.com/lists/oss-security/2015/08/06/6

Source: cve@mitre.org

Broken LinkMailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/03/02/5

Source: cve@mitre.org

Broken LinkMailing ListThird Party Advisory

http://xiphosresearch.com/2016/03/01/Vulnerability-Inheritance-across-Forks.html

Source: cve@mitre.org

ExploitThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/08/06/6

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkMailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/03/02/5

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkMailing ListThird Party Advisory

http://xiphosresearch.com/2016/03/01/Vulnerability-Inheritance-across-Forks.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.