CVE-2023-46815: Input Validation
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with regular user privileges can exploit this.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-46815?
CVE-2023-46815 is a vulnerability found in SugarCRM 12.x before 12.0.4 and 13.x before 13.0.2 that allows unrestricted file upload.
What is the severity of CVE-2023-46815?
CVE-2023-46815 has a severity score of 8.8 (high severity).
How does CVE-2023-46815 affect SugarCRM?
CVE-2023-46815 affects SugarCRM versions 12.x before 12.0.4 and 13.x before 13.0.2.
How can an attacker exploit CVE-2023-46815?
An attacker can exploit CVE-2023-46815 by using a crafted request to inject custom PHP code via the Notes module in SugarCRM.
Is there a fix for CVE-2023-46815?
Yes, the fix for CVE-2023-46815 is available in SugarCRM version 12.0.4 and 13.0.2.