« Volver al listado

CVE-2020-7472

Estado: ModificadaCrítica (9.8)—

An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 allows for unauthenticated remote code execution against a configured SugarCRM instance via crafted HTTP requests. (This is exploitable even after installation is completed.).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sugarcrm — Sugarcrm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7472",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-12T18:15:16.033",
  "references": [
    {
      "url": "https://support.sugarcrm.com/Documentation/Sugar_Versions/10.0/Pro/Sugar_10.0.0_Release_Notes/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2020-043/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.sugarcrm.com/Documentation/Sugar_Versions/10.0/Pro/Sugar_10.0.0_Release_Notes/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2020-043/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 allows for unauthenticated remote code execution against a configured SugarCRM instance via crafted HTTP requests. (This is exploitable even after installation is completed.)."
    },
    {
      "lang": "es",
      "value": "Una omisión de autorización y una vulnerabilidad de inclusión de archivos locales PHP en el componente de instalación de SugarCRM versiones anteriores a 8.0, versiones 8.0 anteriores a 8.0.7, versiones 9.0 anteriores a 9.0.4 y versiones 10.0 anteriores a 10.0.0, permiten una ejecución de código remota no autenticado contra una instancia de SugarCRM configurada por medio de peticiones HTTP diseñadas. (Esto es explotable incluso después de que la instalación es completada)"
    }
  ],
  "lastModified": "2026-06-17T03:24:50.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F008F6E8-D4EA-46C3-B28B-1FD74907CE16",
              "versionEndExcluding": "8.0.7",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6098509-B802-4682-A826-B4AE3E776AE7",
              "versionEndExcluding": "8.0.7",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:ultimate:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE1F47AF-2E32-4191-8790-1713F2D4C2FF",
              "versionEndExcluding": "8.0.7",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57F246BD-A1C4-4175-B110-55DCDED0749E",
              "versionEndExcluding": "9.0.4",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13321C72-94F9-4849-9307-BBC0A696BB68",
              "versionEndExcluding": "9.0.4",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:ultimate:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60ACA353-B7F7-4A7B-8314-7EA8B79F0F58",
              "versionEndExcluding": "9.0.4",
              "versionStartIncluding": "9.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}