Vulnerability · Published Jun 17, 2023 · Assigned by mitre
CVE-2023-35809
High 8.8
In plain English
A high-severity code injection in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.3%top 30.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.
Affected products (as reported)
Weakness: CWE-94