CVE-2023-35808: Malicious File Upload
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using crafted requests, custom PHP code can be injected and executed through the Notes module because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SugarCRM Enterprise Notes moduleto a version that resolves this vulnerability.Fixed in 11.0.6 - Upgrade
Upgrade
SugarCRM 12.x Notes moduleto a version that resolves this vulnerability.Fixed in 12.0.3
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-35808.
What is the severity of CVE-2023-35808?
The severity of CVE-2023-35808 is high with a CVSS score of 8.8.
What software versions are affected by CVE-2023-35808?
SugarCRM Enterprise versions before 11.0.6 and 12.x before 12.0.3 are affected by CVE-2023-35808.
How does CVE-2023-35808 work?
CVE-2023-35808 is an Unrestricted File Upload vulnerability in the Notes module of SugarCRM Enterprise. Attackers can inject and execute custom PHP code through crafted requests.
Are there any patches or updates available for CVE-2023-35808?
Yes, patches or updates are available for CVE-2023-35808. Please refer to the official SugarCRM support website for more information.