Server-Side Request Forgery in SugarCRM API Module

CVE-2024-58258

What is CVE-2024-58258?

SugarCRM versions prior to 13.0.4 and 14.x before 14.0.1 are susceptible to Server-Side Request Forgery (SSRF) through their API module. This vulnerability allows an attacker to manipulate internal requests, potentially exposing sensitive information or enabling further exploitation. By exploiting a limited form of code injection, an unauthorized user can access backend systems that are otherwise protected, raising significant security concerns for organizations utilizing these versions of SugarCRM.

References