CVE-2023-22952
SU
SugarCRM Multiple Products
Multiple SugarCRM Products Remote Code Execution Vulnerability
What it is
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/
- nvd.nist.gov/vuln/detail/CVE-2023-22952
Description and required action as published by CISA. Full record at NVD.