CVE-2017-14510: XSS
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14510?
CVE-2017-14510 has a medium severity rating due to its potential for unauthenticated cross-site scripting (XSS) attacks.
How do I fix CVE-2017-14510?
To mitigate CVE-2017-14510, upgrade SugarCRM to a patched version such as 7.7.2.3, 7.8.2.2, or 7.9.2.0.
Which versions of SugarCRM are affected by CVE-2017-14510?
CVE-2017-14510 affects SugarCRM versions before 7.7.2.3, 7.8.x before 7.8.2.2, 7.9.x before 7.9.2.0, and Sugar Community Edition 6.5.26.
What kind of attack does CVE-2017-14510 facilitate?
CVE-2017-14510 facilitates unauthenticated cross-site scripting (XSS) attacks, which can lead to data theft or user impersonation.
Is it necessary to perform a full system audit after addressing CVE-2017-14510?
Yes, performing a full system audit is recommended to ensure no other vulnerabilities exist after addressing CVE-2017-14510.