CVE-2023-46816
High
Description
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.
SeverityHigh
CVSS8.8
Exploit probability—
ProductSugarcrm
PublishedOct 27, 2023
First seenOct 27, 2023
How to fix
Update
- sugarcrm sugarcrm12.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sugarcrm sugarcrm | 12.0.0 ≤ v < 12.0.4, 13.0.0, 13.0.1 | 12.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.