Medium severity6.1NVD Advisory· Published Sep 17, 2017· Updated May 13, 2026
CVE-2017-14510
CVE-2017-14510
Description
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.
Affected products
10cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*range: <=7.7.2.2
- cpe:2.3:a:sugarcrm:sugarcrm:6.5.26:*:*:*:community:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.8.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sugarcrm:sugarcrm:7.9.1.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/nvdExploitThird Party Advisory
- support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/nvdVendor Advisory
- www.synology.com/support/security/Synology_SA_17_53_SugarCRMnvd
News mentions
0No linked articles in our index yet.