SugarCRM · Multiple Products

CVE-2023-22952

Multiple SugarCRM Products Remote Code Execution Vulnerability

Exploited in attacks High 8.8 Attack chance: 80%

What it is

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

CISA: Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: February 23, 2023

Added to the CISA list: February 2, 2023
Published: January 11, 2023
Severity: High 8.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 80% in the top 0.4% of all known vulnerabilities
Weakness: CWE-20
More details: NVD · CVE.org · CISA

All references (2)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.