PT-2023-25325 · Sugarcrm · Sugarcrm Enterprise

Egidio Romano · Published 2023-06-17 · Updated 2024-12-17 · CVE-2023-35808

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SugarCRM Enterprise versions prior to 11.0.6 SugarCRM Enterprise versions 12.x prior to 12.0.3

Description An Unrestricted File Upload issue has been identified in the Notes module due to missing input validation. This allows custom PHP code to be injected and executed through crafted requests, using regular user privileges. The issue affects not only Enterprise editions but also other editions.

Recommendations For SugarCRM Enterprise versions prior to 11.0.6, update to version 11.0.6 or later to resolve the issue. For SugarCRM Enterprise versions 12.x prior to 12.0.3, update to version 12.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Notes module until a patch is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-35808

Affected Products

Sugarcrm Enterprise

References · 7

• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35808 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35808 · Vendor Advisory
• https://t.me/cvenotify/52576 · Telegram Post
• https://t.me/cvenotify/104571 · Telegram Post
• http://packetstormsecurity.com/files/174300/SugarCRM-12.2.0-Shell-Upload.html · Note
• http://seclists.org/fulldisclosure/2023/Aug/26 · Note