CVE-2023-35809

2023-06-1722:15:09

[email protected]

web.nvd.nist.gov

sugarcrm

rest api

bean manipulation

php code injection

input validation

privilege escalation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.002

Percentile

60.8%

JSON

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.

Affected configurations

Nvd

Node

sugarcrmsugarcrmRange11.0.0–11.0.6enterprise

sugarcrmsugarcrmRange11.0.0–11.0.6professional

sugarcrmsugarcrmRange11.0.0–11.0.6sell

sugarcrmsugarcrmRange11.0.0–11.0.6serve

sugarcrmsugarcrmRange11.0.0–11.0.6ultimate

sugarcrmsugarcrmRange12.0.0–12.0.3enterprise

sugarcrmsugarcrmRange12.0.0–12.0.3sell

sugarcrmsugarcrmRange12.0.0–12.0.3serve

VendorProductVersionCPE
sugarcrmsugarcrm*cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*
sugarcrmsugarcrm*cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:professional:*:*:*
sugarcrmsugarcrm*cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:sell:*:*:*
sugarcrmsugarcrm*cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:serve:*:*:*
sugarcrmsugarcrm*cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:ultimate:*:*:*

Vendor	Product	Version	CPE
sugarcrm	sugarcrm	*	cpe:2.3:a:sugarcrm:sugarcrm:::::enterprise:::*
sugarcrm	sugarcrm	*	cpe:2.3:a:sugarcrm:sugarcrm:::::professional:::*
sugarcrm	sugarcrm	*	cpe:2.3:a:sugarcrm:sugarcrm:::::sell:::*
sugarcrm	sugarcrm	*	cpe:2.3:a:sugarcrm:sugarcrm:::::serve:::*
sugarcrm	sugarcrm	*	cpe:2.3:a:sugarcrm:sugarcrm:::::ultimate:::*