cyfenced.com →

[ CVE-2023-22952 · Published 11 Jan 2023 ]

Multiple SugarCRM Products Remote Code Execution Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 80%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-02-02
  • EPSS: 80% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

CISA: Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 23 Feb 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References