CVE-2017-14509 json
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26).
published 2017-09-17 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-6010
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.8%
- EPSS 5.8% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.
Exploit prediction
5.77% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- blog.ripstech.com https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
blog.ripstech.com
/2017/sugarcrm-security-diet-multiple-vulnerabilities/
exploit, third-party-advisory
-
support.sugarcrm.com
/Resources/Security/sugarcrm-sa-2017-007/
vendor-advisory
- synology.com /support/security/Synology_SA_17_53_SugarCRM
Sources
- CVE List CVE-2017-14509
- NVD CVE-2017-14509
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.