CVE-2019-17306: Code Injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17306?
CVE-2019-17306 is a vulnerability that allows PHP code injection in the Configurator module by an Admin user in SugarCRM before version 8.0.4 and 9.x before 9.0.2.
How severe is CVE-2019-17306?
CVE-2019-17306 has a severity rating of 7.2 (high).
What software versions are affected by CVE-2019-17306?
Versions between 7.9.0.0 and 7.9.5.0, 8.0.0 and 8.0.4, and 9.0.0 and 9.0.2 of SugarCRM Enterprise, Professional, and Ultimate are affected by CVE-2019-17306.
How can I fix CVE-2019-17306?
To fix CVE-2019-17306, it is recommended to upgrade to SugarCRM version 8.0.4 or 9.0.2, depending on your currently installed version.
Where can I find more information about CVE-2019-17306?
More information about CVE-2019-17306 can be found at the following reference: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-033/