CVE-2017-14510

Published: Sep 17, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.

Affected (10)

Products: Sugarcrm: Sugarcrm

Sugarcrm

1 product

Sugarcrm

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Sugarcrm Sugarcrm	Up to 7.7.2.2
Sugarcrm Sugarcrm	Version 6.5.26
Sugarcrm Sugarcrm	Version 7.8.0.0
Sugarcrm Sugarcrm	Version 7.8.0.1
Sugarcrm Sugarcrm	Version 7.8.1.0
Sugarcrm Sugarcrm	Version 7.8.2.0
Sugarcrm Sugarcrm	Version 7.8.2.1
Sugarcrm Sugarcrm	Version 7.9.0.0
Sugarcrm Sugarcrm	Version 7.9.0.1
Sugarcrm Sugarcrm	Version 7.9.1.0