High severity8.8NVD Advisory· Published Sep 17, 2017· Updated Jun 17, 2026
CVE-2017-14509
CVE-2017-14509
Description
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*range: <=7.7.2.2
- cpe:2.3:a:sugarcrm:sugarcrm:6.5.26:*:*:*:community:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.1.0:*:*:*:*:*:*:*
- (no CPE)range: <7.7.2.3, <7.8.2.2, <7.9.2.0, 6.5.26
Patches
Vulnerability mechanics
References
3- blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/nvdExploitThird Party Advisory
- support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/nvdVendor Advisory
- www.synology.com/support/security/Synology_SA_17_53_SugarCRMnvd
News mentions
0No linked articles in our index yet.