CVE-2020-7472

{"id": "CVE-2020-7472", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-11-12T18:15:16.033", "references": [{"url": "https://support.sugarcrm.com/Documentation/Sugar_Versions/10.0/Pro/Sugar_10.0.0_Release_Notes/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2020-043/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 allows for unauthenticated remote code execution against a configured SugarCRM instance via crafted HTTP requests. (This is exploitable even after installation is completed.)."}, {"lang": "es", "value": "Una omisi\u00f3n de autorizaci\u00f3n y una vulnerabilidad de inclusi\u00f3n de archivos locales PHP en el componente de instalaci\u00f3n de SugarCRM versiones anteriores a 8.0, versiones 8.0 anteriores a 8.0.7, versiones 9.0 anteriores a 9.0.4 y versiones 10.0 anteriores a 10.0.0, permiten una ejecuci\u00f3n de c\u00f3digo remota no autenticado contra una instancia de SugarCRM configurada por medio de peticiones HTTP dise\u00f1adas. (Esto es explotable incluso despu\u00e9s de que la instalaci\u00f3n es completada)"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "F008F6E8-D4EA-46C3-B28B-1FD74907CE16", "versionEndExcluding": "8.0.7", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:professional:*:*:*", "vulnerable": true, "matchCriteriaId": "D6098509-B802-4682-A826-B4AE3E776AE7", "versionEndExcluding": "8.0.7", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:ultimate:*:*:*", "vulnerable": true, "matchCriteriaId": "EE1F47AF-2E32-4191-8790-1713F2D4C2FF", "versionEndExcluding": "8.0.7", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "57F246BD-A1C4-4175-B110-55DCDED0749E", "versionEndExcluding": "9.0.4", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:professional:*:*:*", "vulnerable": true, "matchCriteriaId": "13321C72-94F9-4849-9307-BBC0A696BB68", "versionEndExcluding": "9.0.4", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:ultimate:*:*:*", "vulnerable": true, "matchCriteriaId": "60ACA353-B7F7-4A7B-8314-7EA8B79F0F58", "versionEndExcluding": "9.0.4", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}