CVE-2017-14509
Last modified
CVE-2017-14509 is a vulnerability of currently unknown severity. An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. EPSS estimates a 5.77% chance of exploitation in the next 30 days.
Description
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sugarcrm | Sugarcrm | <= 7.7.2.2 |
| Sugarcrm | Sugarcrm | 6.5.26 |
| Sugarcrm | Sugarcrm | 7.8.0.0 |
| Sugarcrm | Sugarcrm | 7.8.0.1 |
| Sugarcrm | Sugarcrm | 7.8.1.0 |
| Sugarcrm | Sugarcrm | 7.8.2.0 |
| Sugarcrm | Sugarcrm | 7.8.2.1 |
| Sugarcrm | Sugarcrm | 7.9.0.0 |
| Sugarcrm | Sugarcrm | 7.9.0.1 |
| Sugarcrm | Sugarcrm | 7.9.1.0 |
References
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14509?
How severe is CVE-2017-14509?
How do I fix CVE-2017-14509?
Are you affected by CVE-2017-14509?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST