CVE-2014-3244

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-02-01 · updated 2026-06-17
Weakness: CWE-611

Description

XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.

Affected products

SugarCRM: before 6.5.16 — fixed in 6.5.16

How to fix

Upgrade to a fixed version: SugarCRM 6.5.16. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2014/Jun/92
http://www.securityfocus.com/bid/68102
https://web.archive.org/web/20151105182132/http://www.pnigos.com/?p=294
http://seclists.org/fulldisclosure/2014/Jun/92
http://www.securityfocus.com/bid/68102
https://web.archive.org/web/20151105182132/http://www.pnigos.com/?p=294

Get alerted when CVE-2014-3244 or the next vulnerability affects your stack