CVE-2014-3244 XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in a...
CriticalCVSS 9.8
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sugarcrm | < 6.5.16 | 6.5.16 |
References
- 20140618 [CVE-2014-3244]SugarCRM v6.5.16 rss dashlet LFI via XXE Attack mailing-list third-party-advisory
- 68102 third-party-advisory vdb-entry
- web.archive.org exploit third-party-advisory