- Vendor / Project
- SugarCRM
- Product
- Multiple Products
- Date added
- Feb 2, 2023
- Due date
- Feb 23, 2023
- Known ransomware use
- Unknown
- CWEs
- CWE-20
Description
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Required action
Apply updates per vendor instructions.