Vulnerability Description
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sugarcrm | Sugarcrm | <= 7.7.2.2 |
Related Weaknesses (CWE)
References
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ExploitThird Party Advisory
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/Vendor Advisory
- https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
- https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ExploitThird Party Advisory
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/Vendor Advisory
- https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
FAQ
What is CVE-2017-14509?
CVE-2017-14509 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors m...
How severe is CVE-2017-14509?
CVE-2017-14509 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-14509?
Check the references section above for vendor advisories and patch information. Affected products include: Sugarcrm Sugarcrm.