CVE

CVE-2023-22952

Multiple SugarCRM Products Remote Code Execution Vulnerability

SugarCRM · Multiple Products

Date added (CISA)

2023-02-02

Remediation due

2023-02-23

Known ransomware use

Not indicated

Remediation priority

P2 — past CISA due date

Description

Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

Source: NVD ↗ · CISA KEV Catalog ↗