CVE-2023-46816: Input Validation
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-46816?
CVE-2023-46816 is a Server Site Template Injection (SSTI) vulnerability in SugarCRM versions 12 before 12.0.4 and 13 before 13.0.2.
How severe is CVE-2023-46816?
CVE-2023-46816 has a severity score of 8.8 (high).
Which versions of SugarCRM are affected by CVE-2023-46816?
SugarCRM versions 12 before 12.0.4 and 13 before 13.0.2 are affected by CVE-2023-46816.
How can I fix CVE-2023-46816?
To fix CVE-2023-46816, you should upgrade SugarCRM to version 12.0.4 or 13.0.2.
Where can I find more information about CVE-2023-46816?
You can find more information about CVE-2023-46816 in the SugarCRM security advisory: https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/