CVE-2019-17304: Code Injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17304?
CVE-2019-17304 is a vulnerability in SugarCRM before version 8.0.4 and 9.x before 9.0.2 that allows PHP code injection in the MergeRecords module by an Admin user.
How does CVE-2019-17304 affect SugarCRM?
CVE-2019-17304 affects SugarCRM versions before 8.0.4 and 9.x before 9.0.2 by allowing PHP code injection in the MergeRecords module.
What is the severity of CVE-2019-17304?
CVE-2019-17304 has a severity rating of 7.2, which is considered high.
How can I fix CVE-2019-17304?
To fix CVE-2019-17304, it is recommended to upgrade to SugarCRM version 8.0.4 or 9.0.2, depending on your current version.
Where can I find more information about CVE-2019-17304?
More information about CVE-2019-17304 can be found in the official SugarCRM security advisory: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-031/