WID-SEC-2024-3063 — SugarCRM Sugar Enterprise: Mehrere Schwachstellen

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SugarCRM Sugar Enterprise ausnutzen, einen Cross Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Informationen offenzulegen, Daten zu manipulieren und Code zur Ausführung zu bringen.

Product

SugarCRM ist ein Enterprise CRM Produkt für Vertriebs-, Marketing- und Serviceteams über den gesamten Kundenlebenszyklus.

Vulnerabilities 1

High 7.2

CVE-2024-58258 Public exploit EPSS 22%

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection ca…

SugarCRM SugarCRM

Jul 13, 2025

Revision history

2025-11-23 #3
PoC für CVE-2024-58258 aufgenommen
2025-07-14 #2
CVE-2024-58258 ergänzt
2024-10-03 #1
Initiale Fassung

References

sugarcrm-sa-2024-019 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-019/
sugarcrm-sa-2024-020 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-020/
sugarcrm-sa-2024-021 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-021/
sugarcrm-sa-2024-022 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-022/
sugarcrm-sa-2024-023 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-023/
sugarcrm-sa-2024-024 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-024/
sugarcrm-sa-2024-025 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-025/
sugarcrm-sa-2024-026 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-026/
sugarcrm-sa-2024-027 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-027/
sugarcrm-sa-2024-028 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-028/
sugarcrm-sa-2024-029 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-029/
sugarcrm-sa-2024-030 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-030/
sugarcrm-sa-2024-031 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-031/
sugarcrm-sa-2024-032 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-032/
sugarcrm-sa-2024-033 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-033/
sugarcrm-sa-2024-034 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-034/
sugarcrm-sa-2024-035 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-035/
sugarcrm-sa-2024-036 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-036/
sugarcrm-sa-2024-037 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-037/
sugarcrm-sa-2024-038 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-038/
sugarcrm-sa-2024-039 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-039/
sugarcrm-sa-2024-040 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-040/
sugarcrm-sa-2024-041 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-041/
sugarcrm-sa-2024-042 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-042/
sugarcrm-sa-2024-043 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-043/
sugarcrm-sa-2024-044 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-044/
sugarcrm-sa-2024-045 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-045/
sugarcrm-sa-2024-046 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-046/
sugarcrm-sa-2024-047 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-047/
sugarcrm-sa-2024-048 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-048/
sugarcrm-sa-2024-049 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-049/
sugarcrm-sa-2024-050 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-050/
sugarcrm-sa-2024-051 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-051/
sugarcrm-sa-2024-052 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-052/
sugarcrm-sa-2024-053 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-053/
sugarcrm-sa-2024-054 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-054/
sugarcrm-sa-2024-055 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-055/
sugarcrm-sa-2024-056 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-056/
sugarcrm-sa-2024-057 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-057/
sugarcrm-sa-2024-058 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-058/
sugarcrm-sa-2024-059 vom 2024-10-03
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2024-059/
PoC CVE-2024-58258 vom 2025-11-23
https://github.com/Web3-Serializer/CVE-2024-58258/blob/main/main.py