« Volver al listado

CVE-2017-14508

Estado: ModificadaAlta (8.8)—

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sugarcrm — Sugarcrm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-14508",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-17T21:29:00.217",
  "references": [
    {
      "url": "https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits."
    },
    {
      "lang": "es",
      "value": "Existe un problema en SugarCRM en versiones anteriores a la 7.7.2.3, en versiones 7.8.x anteriores a la 7.8.2.2 y en versiones 7.9.x anteriores a la 7.9.2.0 (y Sugar Community Edition 6.5.26). Se identificaron múltiples áreas en el módulo Documents and Emails que podrían permitir a un usuario autenticado ejecutar inyecciones SQL, tal y como se demuestra con el carácter barra invertida al final de un bean_id para modules/Emails/DetailView.php. Un atacante podría explotar estas vulnerabilidades mediante el envío de una petición SQL manipulada a las áreas afectadas. Un exploit podría permitir que el atacante modifique la base de datos SQL. Un escapado SQL correcto prevendría dicho exploit."
    }
  ],
  "lastModified": "2026-06-17T01:06:17.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CF7DEB0-D9C7-4422-8632-F70D7EE23DB9",
              "versionEndIncluding": "7.7.2.2"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.5.26:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3E99EB2-05BF-4575-9170-D9014B2D6B5A"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD5EB33E-9B9E-4D05-928E-55D53F94A698"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62260AB3-77B6-4E7D-9ECF-AB0871F01E52"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.8.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B59B76F-5141-47BE-975D-356742C13659"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F20AB20-1C40-4192-8B1D-0C227681F2EE"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2021DD4C-B55B-4C52-B46B-C71AE71E1B48"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6A722A2-2DD7-4513-85B2-5DE2886D1AC2"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D34FE48A-1DA0-4F87-9C62-507123D070AA"
            },
            {
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:7.9.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DA7C251-86A8-4B1C-9296-C6008CAF65DF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}