High severity8.8NVD Advisory· Published Sep 17, 2017· Updated May 13, 2026
CVE-2017-14509
CVE-2017-14509
Description
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.
Affected products
10cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*range: <=7.7.2.2
- cpe:2.3:a:sugarcrm:sugarcrm:6.5.26:*:*:*:community:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.1.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/nvdExploitThird Party Advisory
- support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/nvdVendor Advisory
- www.synology.com/support/security/Synology_SA_17_53_SugarCRMnvd
News mentions
0No linked articles in our index yet.