« Volver al listado

CVE-2023-35811

Estado: ModificadaAlta (8.8)—

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input validation. Regular user privileges can use used for exploitation. Editions other than Enterprise are also affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sugarcrm — Sugarcrm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-35811",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-35811",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-17T16:22:17.744426Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-06-17T22:15:09.590",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/174303/SugarCRM-12.2.0-SQL-Injection.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2023/Aug/29",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-008/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/174303/SugarCRM-12.2.0-SQL-Injection.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2023/Aug/29",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-008/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input validation. Regular user privileges can use used for exploitation. Editions other than Enterprise are also affected."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en SugarCRM Enterprise antes de v11.0.6 y v12.x antes de v12.0.3. Se han identificado dos vectores de inyección SQL en la API REST. Mediante el uso de peticiones manipuladas, código SQL personalizado puede ser inyectado a través de la API REST debido a la falta de validación de entrada. Los privilegios de un usuario normal pueden utilizarse para la explotación. Las ediciones distintas a Enterprise también se ven afectadas. "
    }
  ],
  "lastModified": "2026-06-17T06:05:15.307",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2920E2F-99C4-4C67-9336-BD5A02EC0E71",
              "versionEndExcluding": "11.0.6",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A6F5559-F05F-43B8-A972-E06B5AD0B249",
              "versionEndExcluding": "11.0.6",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:sell:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2391868-9E0B-44D3-8206-B4D66FF98374",
              "versionEndExcluding": "11.0.6",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:serve:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8165A201-F418-46B5-8574-FEECF535D00D",
              "versionEndExcluding": "11.0.6",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:ultimate:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67E235C5-274C-45DD-B3E2-266E8A9E778B",
              "versionEndExcluding": "11.0.6",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0239BDAF-6DF6-4CC7-97C6-53EB4BEFB784",
              "versionEndExcluding": "12.0.3",
              "versionStartIncluding": "12.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:sell:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BC5281D-BEA4-4AE7-ACAF-5814E5E62CAC",
              "versionEndExcluding": "12.0.3",
              "versionStartIncluding": "12.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:serve:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "539A1F9D-92B2-43A4-B28C-19B1C25B2A45",
              "versionEndExcluding": "12.0.3",
              "versionStartIncluding": "12.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}