CVE-2023-35810

State: Published
Severity: Not scored
Published: Jun 17, 2023
Updated: Dec 17, 2024
Reserved: Jun 17, 2023

Description

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has been identified in the DocuSign module. By using crafted requests, custom PHP code can be injected and executed through the DocuSign module because of missing input validation. Admin user privileges are required to exploit this vulnerability. Editions other than Enterprise are also affected.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-009/
20230823 [KIS-2023-07] SugarCRM <= 12.2.0 (Docusign_GlobalSettings) PHP Object Injection Vulnerabilitymailing-list
http://packetstormsecurity.com/files/174302/SugarCRM-12.2.0-PHP-Object-Injection.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.