CVE-2023-35809

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jun 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-35818.1Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APCVE-2023-358107.2An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has bCVE-2023-358118.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the RCVE-2023-358125.3An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111CVE-2023-358139.8Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce througCVE-2023-358149.8DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.CVE-2023-358159.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.CVE-2023-358165.3DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.CVE-2023-358179.8DevExpress before 23.1.3 allows AsyncDownloader SSRF.CVE-2023-358186.8An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability toCVE-2023-35824.3Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a BoardCVE-2023-358237.0An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134