CVE-2023-22952: Multiple SugarCRM Products Remote Code Execution Vulnerability
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Other sources
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Hotfix 91155
Event History
Frequently Asked Questions
What is CVE-2023-22952?
CVE-2023-22952 is a remote code execution vulnerability found in multiple SugarCRM products.
How does CVE-2023-22952 work?
CVE-2023-22952 allows a malicious actor to inject custom PHP code through the EmailTemplates functionality in SugarCRM products.
What is the severity of CVE-2023-22952?
The severity of CVE-2023-22952 is high.
How can I mitigate CVE-2023-22952?
To mitigate CVE-2023-22952, it is recommended to apply the security patch provided by SugarCRM.
Where can I find more information about CVE-2023-22952?
You can find more information about CVE-2023-22952 in the SugarCRM support website: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/