CVE-2023-22952β€”Multiple SugarCRM Products Remote Code Execution Vulnerability

PUBLISHEDvulnerability record
2023-02-02 Β· last modified June 21, 2025

Metadata

CVE ID:
CVE-2023-22952
Project:
SugarCRM
Product:
Multiple Products
Date Added:
2023-02-02
Due Date:
2023-02-23
Last Updated:
June 21, 2025

Vulnerability Name

Multiple SugarCRM Products Remote Code Execution Vulnerability

Description

Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:
Unknown

Action

Apply updates per vendor instructions.

Additional Notes

  • https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/
  • https://nvd.nist.gov/vuln/detail/CVE-2023-22952

Related Weaknesses

browse all CVEs