Actively exploited · Published Jan 11, 2023 · Assigned by mitre
CVE-2023-22952
High 8.8 Exploited
In plain English
A high-severity code injection in Multiple Products from SugarCRM. Attackers are actively exploiting it in the wild (listed by CISA on February 2, 2023). The chance it is exploited in the next 30 days is estimated at 80.1% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Feb 23, 2023.
Official description
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H