PT-2020-19601 · Sugarcrm · Sugarcrm

Published 2020-11-12 · Updated 2021-07-21 · CVE-2020-7472

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0 SugarCRM versions 8.0 through 8.0.6 SugarCRM versions 9.0 through 9.0.3 SugarCRM versions 10.0 through 10.0.0

Description The issue concerns an authorization bypass and PHP local-file-include vulnerability in the installation component. This allows for unauthenticated remote code execution against a configured instance via crafted HTTP requests. The vulnerability remains exploitable even after the installation is completed.

Recommendations For SugarCRM versions prior to 8.0, update to version 8.0 or later. For SugarCRM versions 8.0 through 8.0.6, update to version 8.0.7 or later. For SugarCRM versions 9.0 through 9.0.3, update to version 9.0.4 or later. For SugarCRM versions 10.0 through 10.0.0, update to a version later than 10.0.0.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

CVE-2020-7472

Affected Products

Sugarcrm

References · 4

• https://support.sugarcrm.com/Documentation/Sugar_Versions/10.0/Pro/Sugar_10.0.0_Release_Notes · Vendor Advisory
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2020-043 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7472 · Security Note