CVE-2019-17298: SQL Injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17298?
CVE-2019-17298 is a vulnerability in SugarCRM before 8.0.4 and 9.x before 9.0.2 that allows SQL injection in the Administration module by a Developer user.
Which software versions are affected by CVE-2019-17298?
CVE-2019-17298 affects SugarCRM versions from 7.9.0.0 to 7.9.5.0 (Enterprise and Professional) and versions from 8.0.0 to 8.0.4 (Enterprise, Professional, and Ultimate), as well as versions from 9.0.0 to 9.0.2 (Enterprise, Professional, and Ultimate).
What is the severity of CVE-2019-17298?
CVE-2019-17298 has a severity level of 8.8 (High).
How can I fix CVE-2019-17298?
To fix CVE-2019-17298, it is recommended to update to SugarCRM version 8.0.4 or 9.0.2 depending on your current version. Refer to the advisory for more details.
Where can I find more information about CVE-2019-17298?
You can find more information about CVE-2019-17298 in the SugarCRM security advisory: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-025/