CVE-2017-14510

Опубликовано: 17 сент. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.

Ссылки

https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
Exploit
Third Party Advisory
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/
Vendor Advisory
https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
Exploit
Third Party Advisory
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/
Vendor Advisory
https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*

Версия до 7.7.2.2 (включая)

cpe:2.3:a:sugarcrm:sugarcrm:6.5.26:*:*:*:community:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.1.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.1:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.0:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.1:*:*:*:*:*:*:*

cpe:2.3:a:sugarcrm:sugarcrm:7.9.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 56%

0.00341

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-w59v-cjq7-x6rw