CVE-2019-17308: Code Injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17308?
CVE-2019-17308 is a vulnerability in SugarCRM before 8.0.4 and 9.x before 9.0.2 that allows PHP code injection in the Emails module by a regular user.
How severe is CVE-2019-17308?
CVE-2019-17308 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2019-17308?
CVE-2019-17308 affects SugarCRM versions between 7.9.0.0 and 7.9.5.0 (Enterprise and Professional editions), between 8.0.0 and 8.0.4 (Enterprise, Professional, and Ultimate editions), and between 9.0.0 and 9.0.2 (Enterprise, Professional, and Ultimate editions).
How can I fix CVE-2019-17308?
To fix CVE-2019-17308, upgrade your SugarCRM installation to version 8.0.4 or 9.0.2, depending on your current version.
Where can I find more information about CVE-2019-17308?
More information about CVE-2019-17308 can be found at the following link: [https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-035/](https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-035/)