CVE-2019-17303: Code Injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17303?
CVE-2019-17303 is a vulnerability in SugarCRM before version 8.0.4 and 9.x before 9.0.2 that allows PHP code injection in the MergeRecords module by a Developer user.
How severe is CVE-2019-17303?
CVE-2019-17303 has a severity rating of 8.8 (high).
Which versions of SugarCRM are affected by CVE-2019-17303?
CVE-2019-17303 affects SugarCRM versions between 7.9.0.0 and 7.9.5.0, 8.0.0 and 8.0.4, and 9.0.0 and 9.0.2 for both Enterprise, Professional, and Ultimate editions.
How can I fix CVE-2019-17303?
To fix CVE-2019-17303, you should update your SugarCRM installation to version 8.0.4 or 9.0.2 depending on the edition you are using.
Where can I find more information about CVE-2019-17303?
More information about CVE-2019-17303 can be found at the following link: [SugarCRM Security Advisory](https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-030/)