CVE-2017-14510

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/Vendor Advisory
https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/Vendor Advisory
https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM

Timeline

Published: Sep 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-145117.5An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting applica CVE-2017-145129.8NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability th CVE-2017-145135.3Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename CVE-2017-145147.5Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL.CVE-2017-145157.5Heap-based Buffer Overflow on Tenda W15E devices before 15.11.0.14 allows remote attackers to cause a denial of service (temporary HTTP outa CVE-2017-145166.1Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292.CVE-2017-145175.5In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document.CVE-2017-145187.8In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document.CVE-2017-145197.5In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go CVE-2017-14527.8IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user to obtain elevated priv CVE-2017-145207.8In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when han CVE-2017-145218.8In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.