{
  "id": "CVE-2023-35808",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-06-17T22:15:09.477",
  "lastModified": "2024-12-17T17:15:07.730",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using crafted requests, custom PHP code can be injected and executed through the Notes module because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "11.0.0",
              "versionEndExcluding": "11.0.6",
              "matchCriteriaId": "F2920E2F-99C4-4C67-9336-BD5A02EC0E71"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:professional:*:*:*",
              "versionStartIncluding": "11.0.0",
              "versionEndExcluding": "11.0.6",
              "matchCriteriaId": "6A6F5559-F05F-43B8-A972-E06B5AD0B249"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:sell:*:*:*",
              "versionStartIncluding": "11.0.0",
              "versionEndExcluding": "11.0.6",
              "matchCriteriaId": "C2391868-9E0B-44D3-8206-B4D66FF98374"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:serve:*:*:*",
              "versionStartIncluding": "11.0.0",
              "versionEndExcluding": "11.0.6",
              "matchCriteriaId": "8165A201-F418-46B5-8574-FEECF535D00D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:ultimate:*:*:*",
              "versionStartIncluding": "11.0.0",
              "versionEndExcluding": "11.0.6",
              "matchCriteriaId": "67E235C5-274C-45DD-B3E2-266E8A9E778B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "12.0.0",
              "versionEndExcluding": "12.0.3",
              "matchCriteriaId": "0239BDAF-6DF6-4CC7-97C6-53EB4BEFB784"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:sell:*:*:*",
              "versionStartIncluding": "12.0.0",
              "versionEndExcluding": "12.0.3",
              "matchCriteriaId": "9BC5281D-BEA4-4AE7-ACAF-5814E5E62CAC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:serve:*:*:*",
              "versionStartIncluding": "12.0.0",
              "versionEndExcluding": "12.0.3",
              "matchCriteriaId": "539A1F9D-92B2-43A4-B28C-19B1C25B2A45"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/174300/SugarCRM-12.2.0-Shell-Upload.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2023/Aug/26",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-006/",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://packetstormsecurity.com/files/174300/SugarCRM-12.2.0-Shell-Upload.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2023/Aug/26",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-006/",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}