| Package | Affected versions | Patched versions |
|---|---|---|
| sugarcrm | = 1.0= 1.0f= 1.0g= 1.1= 1.1a= 1.1b= 1.1c= 1.1d= 1.1e= 1.1f= 1.5d= 2.0.1= 2.0.1a= 2.0.1c= 3.0.1= 3.5= 3.5.1= 4.0= 4.0.1= 4.1= 4.2= 4.2.1= 4.5.0= 4.5.0f= 4.5.1= 4.5.1i= 4.5.1o= 5.0.0= 5.0.0h= 5.0.0k= 5.1.0= 5.1.0-beta= 5.1c= 5.1l= 5.2.0g= 5.2a= 5.2c= 5.2d= 5.2e= 5.2f= 5.2g= 5.2h= 5.5= 5.5.0= 5.5.1= 5.5.2= 5.5.3= 5.5.4= 5.5a= 6.0= 6.0.1= 6.0.2= 6.0.3= 6.1.0= 6.1.1≤ 6.1.2 |
SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free