PT-2023-30231 · Sugarcrm · Sugarcrm

Egidio Romano · Publicado 2023-10-27 · Atualizado 2024-06-03 · CVE-2023-46815

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 12.0.4 SugarCRM versions prior to 13.0.2

Description An issue has been discovered in the Notes module, allowing for an Unrestricted File Upload. This is due to missing input validation, which enables an attacker to inject custom PHP code via a crafted request. The issue can be exploited by an attacker with regular user privileges.

Recommendations For versions prior to 12.0.4, update to version 12.0.4 or later. For versions prior to 13.0.2, update to version 13.0.2 or later. As a temporary workaround, consider disabling the Notes module until a patch is available. Restrict access to the set note attachment function to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-46815

Produtos afetados

Sugarcrm

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-46815 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-46815 · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/75 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/10613 · Publicação no Telegram
• https://twitter.com/ksg93rd/status/1797653837442085072 · Publicação no Twitter
• https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011 · Aviso do Fabricante