CVE-2005-4086: Medium severity SugarCRM Sugar Suite vulnerability

Published Dec 8, 2005

Updated

Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter.

Affected Software

2 affected components

SugarCRM Sugar Suite=3.5

SugarCRM Sugar Suite=4.0_beta

Event History

Dec 8, 2005

CVE Published

11:03 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4086?

CVE-2005-4086 is considered a high severity vulnerability due to its potential for remote file inclusion.

How do I fix CVE-2005-4086?

To fix CVE-2005-4086, upgrade to a version of SugarCRM that is not affected, such as a version after the 4.0 beta.

What systems are affected by CVE-2005-4086?

CVE-2005-4086 affects Sugar Suite versions 3.5 and 4.0 beta of SugarCRM.

Can CVE-2005-4086 lead to remote code execution?

Yes, CVE-2005-4086 may allow attackers to execute arbitrary code on the server by including local files.

What attack vectors are associated with CVE-2005-4086?

Attackers can exploit CVE-2005-4086 through manipulated requests that include directory traversal sequences.