CVE-2017-14509

Опубликовано: 17 сент. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.

Ссылки

https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
Exploit
Third Party Advisory
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/
Vendor Advisory
https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
Exploit
Third Party Advisory
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/
Vendor Advisory
https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*

Версия до 7.7.2.2 (включая)

cpe:2.3:a:sugarcrm:sugarcrm:6.5.26:*:*:*:community:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.1.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.1:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.1:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.9.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.0079

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-4g2w-mjfj-p2m9