PT-2019-15065
CVE-2019-17302
·
Published
2019-10-07
·
Updated
2020-08-24
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
SugarCRM versions prior to 8.0.4
SugarCRM versions 9.x prior to 9.0.2
Description
The issue allows PHP code injection in the ModuleBuilder module by a Developer user.
Recommendations
For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later.
For SugarCRM versions 9.x prior to 9.0.2, update to version 9.0.2 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾