Description

An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 allows for unauthenticated remote code execution against a configured SugarCRM instance via crafted HTTP requests. (This is exploitable even after installation is completed.).

Remediation

References

CVE-2020-7472

Related Vulnerabilities

Oracle JRE CVE-2017-10347 Vulnerability (CVE-2017-10347)

OpenVPN AS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-2061)

WordPress Plugin Conditional Payments for WooCommerce Cross-Site Request Forgery (2.3.1)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Cross-Site Scripting (2.8.4)

MongoDb Improper Input Validation Vulnerability (CVE-2012-6619)

Severity

Critical

Classification

CVE-2020-7472 CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities