CVE-2019-17292: SQL Injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by an Admin user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17292?
CVE-2019-17292 is a vulnerability in SugarCRM before version 8.0.4 and 9.x before 9.0.2 that allows SQL injection in the pmse_Inbox module by an Admin user.
How severe is CVE-2019-17292?
CVE-2019-17292 has a severity score of 7.2 (high).
Which software versions are affected by CVE-2019-17292?
The affected software versions include SugarCRM Enterprise versions between 7.9.0.0 and 7.9.5.0, SugarCRM Enterprise versions between 8.0.0 and 8.0.4, SugarCRM Enterprise versions between 9.0.0 and 9.0.2, SugarCRM Professional versions between 7.9.0.0 and 7.9.5.0, SugarCRM Professional versions between 8.0.0 and 8.0.4, and SugarCRM Professional versions between 9.0.0 and 9.0.2.
How can I fix CVE-2019-17292?
To fix CVE-2019-17292, you should upgrade your SugarCRM installation to version 8.0.4 or 9.0.2 depending on the edition you are using.
Where can I find more information about CVE-2019-17292?
You can find more information about CVE-2019-17292 on the SugarCRM website: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-019/