PT-2023-30231 · Sugarcrm · Sugarcrm

Egidio Romano · Published 2023-10-27 · Updated 2024-06-03 · CVE-2023-46815

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 12.0.4 SugarCRM versions prior to 13.0.2

Description An issue has been discovered in the Notes module, allowing for an Unrestricted File Upload. This is due to missing input validation, which enables an attacker to inject custom PHP code via a crafted request. The issue can be exploited by an attacker with regular user privileges.

Recommendations For versions prior to 12.0.4, update to version 12.0.4 or later. For versions prior to 13.0.2, update to version 13.0.2 or later. As a temporary workaround, consider disabling the Notes module until a patch is available. Restrict access to the set note attachment function to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-46815

Affected Products

Sugarcrm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-46815 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46815 · Vendor Advisory
• https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011 · Vendor Advisory
• https://t.me/latest_high_impact_cve/75 · Telegram Post
• https://t.me/cybersecuritytechnologies/10613 · Telegram Post
• https://twitter.com/ksg93rd/status/1797653837442085072 · Twitter Post