A vulnerability, which was classified as critical, was found in SugarCRM up to 8.0.3/9.0.1. Affected is some unknown functionality of the component Attachment Handler. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

The weakness was published 10/07/2019. This vulnerability is traded as CVE-2019-17311 since 10/07/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. A authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 8.0.4 or 9.0.2 eliminates this vulnerability.

Similar entries are available at VDB-143044, VDB-143043, VDB-143042 and VDB-143041. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• SugarCRM

Version

• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 9.0.0
• 9.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion