CVE-2019-17305: Code Injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17305?
CVE-2019-17305 is a vulnerability in SugarCRM before 8.0.4 and 9.x before 9.0.2 that allows PHP code injection in the MergeRecords module by a Regular user.
What is the severity of CVE-2019-17305?
The severity of CVE-2019-17305 is high with a severity value of 8.8.
Which software versions are affected by CVE-2019-17305?
CVE-2019-17305 affects SugarCRM versions 7.9.0.0 to 7.9.5.0, 8.0.0 to 8.0.4, and 9.0.0 to 9.0.2 for the Enterprise, Professional, and Ultimate editions.
How can I fix CVE-2019-17305?
To fix CVE-2019-17305, you should upgrade SugarCRM to version 8.0.4 or 9.0.2, depending on your edition.
Where can I find more information about CVE-2019-17305?
You can find more information about CVE-2019-17305 at the following link: [https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-032/](https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-032/)