CVE-2023-46815

Published: Oct 27, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with regular user privileges can exploit this.

Affected (9)

Products: Sugarcrm: Sugarcrm

Sugarcrm

1 product

Sugarcrm

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Sugarcrm Sugarcrm	From 12.0.0 to 12.0.4
Sugarcrm Sugarcrm	From 12.0.0 to 12.0.4
Sugarcrm Sugarcrm	From 12.0.0 to 12.0.4
Sugarcrm Sugarcrm	Version 13.0.0
Sugarcrm Sugarcrm	Version 13.0.0
Sugarcrm Sugarcrm	Version 13.0.0
Sugarcrm Sugarcrm	Version 13.0.1
Sugarcrm Sugarcrm	Version 13.0.1
Sugarcrm Sugarcrm	Version 13.0.1

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011/

Source: cve@mitre.org

Vendor Advisory

https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.