CVE-2023-35809

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-17 · updated 2026-06-17
Weakness: CWE-94

Description

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.

Affected products

SugarCRM: from 11.0.0 before 11.0.6; from 12.0.0 before 12.0.3 — fixed in 11.0.6, 12.0.3

How to fix

Upgrade to a fixed version: SugarCRM 11.0.6, 12.0.3. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/174301/SugarCRM-12.2.0-Bean-Manipulation.html
http://seclists.org/fulldisclosure/2023/Aug/27
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-007/
http://packetstormsecurity.com/files/174301/SugarCRM-12.2.0-Bean-Manipulation.html
http://seclists.org/fulldisclosure/2023/Aug/27
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-007/

Get alerted when CVE-2023-35809 or the next vulnerability affects your stack