Lucene search

[email protected]CVE-2009-2978

HistoryAug 27, 2009 - 6:30 p.m.

CVE-2009-2978

2009-08-2718:30:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2009-2978

sql injection

vulnerability

sugarcrm

remote attackers

arbitrary sql commands

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.6 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.4%

JSON

SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected configurations

NVD

Node

sugarcrmsugarcrmRange≤4.5.1o

sugarcrmsugarcrmRange≤5.0.0ksugar_community_edition

sugarcrmsugarcrmRange≤5.2.0g

sugarcrmsugarcrmMatch1.0

sugarcrmsugarcrmMatch1.0f

sugarcrmsugarcrmMatch1.0g

sugarcrmsugarcrmMatch1.1

sugarcrmsugarcrmMatch1.1a

sugarcrmsugarcrmMatch1.1b

sugarcrmsugarcrmMatch1.1c

sugarcrmsugarcrmMatch1.1d

sugarcrmsugarcrmMatch1.1e

sugarcrmsugarcrmMatch1.1f

sugarcrmsugarcrmMatch1.5d

sugarcrmsugarcrmMatch2.0.1

sugarcrmsugarcrmMatch2.0.1a

sugarcrmsugarcrmMatch2.0.1c

sugarcrmsugarcrmMatch3.0.1

sugarcrmsugarcrmMatch3.5

sugarcrmsugarcrmMatch3.5.1

sugarcrmsugarcrmMatch4.0

sugarcrmsugarcrmMatch4.0.1

sugarcrmsugarcrmMatch4.1

sugarcrmsugarcrmMatch4.2

sugarcrmsugarcrmMatch4.2.1

sugarcrmsugarcrmMatch4.5.0

sugarcrmsugarcrmMatch4.5.0f

sugarcrmsugarcrmMatch4.5.1

sugarcrmsugarcrmMatch5.0.0sugar_community_edition

sugarcrmsugarcrmMatch5.0.0hsugar_community_edition

sugarcrmsugarcrmMatch5.2a

sugarcrmsugarcrmMatch5.2c

sugarcrmsugarcrmMatch5.2d

sugarcrmsugarcrmMatch5.2e

sugarcrmsugarcrmMatch5.2esugar_community_edition

sugarcrmsugarcrmMatch5.2f

CPENameOperatorVersion
sugarcrm:sugarcrmsugarcrmle4.5.1o
sugarcrm:sugarcrmsugarcrmle5.0.0k
sugarcrm:sugarcrmsugarcrmle5.2.0g
sugarcrm:sugarcrmsugarcrmeq1.0
sugarcrm:sugarcrmsugarcrmeq1.0f
sugarcrm:sugarcrmsugarcrmeq1.0g
sugarcrm:sugarcrmsugarcrmeq1.1
sugarcrm:sugarcrmsugarcrmeq1.1a
sugarcrm:sugarcrmsugarcrmeq1.1b
sugarcrm:sugarcrmsugarcrmeq1.1c

CPE	Name	Operator	Version
sugarcrm:sugarcrm	sugarcrm	le	4.5.1o
sugarcrm:sugarcrm	sugarcrm	le	5.0.0k
sugarcrm:sugarcrm	sugarcrm	le	5.2.0g
sugarcrm:sugarcrm	sugarcrm	eq	1.0
sugarcrm:sugarcrm	sugarcrm	eq	1.0f
sugarcrm:sugarcrm	sugarcrm	eq	1.0g
sugarcrm:sugarcrm	sugarcrm	eq	1.1
sugarcrm:sugarcrm	sugarcrm	eq	1.1a
sugarcrm:sugarcrm	sugarcrm	eq	1.1b
sugarcrm:sugarcrm	sugarcrm	eq	1.1c

Rows per page:

1-10 of 351

References

jvn.jp/en/jp/JVN31035930/index.html

jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000056.html

secunia.com/advisories/36423

www.ipa.go.jp/security/vuln/documents/2009/200908_sugarcrm.html

www.securityfocus.com/bid/36118

www.sugarcrm.com/forums/showthread.php?t=50907

www.sugarcrm.com/forums/showthread.php?t=50953

exchange.xforce.ibmcloud.com/vulnerabilities/52679

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.6 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.4%

JSON

Related for CVE-2009-2978

jvn1 ubuntucve1 cvelist1 prion1 nvd1