Action needed - January 4, 2023: SugarCRM Hotfix for critical security vulnerability

RE: Action needed - January 4, 2023: SugarCRM Hotfix for critical security vulnerability

Alex Nassi — Thu, 05 Jan 2023 23:40:19 GMT

Please review the most recent information and updates here.

RE: Action needed - January 4, 2023: SugarCRM Hotfix for critical security vulnerability

Murray Crane — Thu, 05 Jan 2023 18:36:39 GMT

Turns out our on-site was "exploited" (which I discovered while applying the hot fix). Not a problem, killed everything that was running and (after taking copies of the payload) deleted it all. Would like to thank Wilfred for posting that link, otherwise I'd have had no real information about this. Only other complaint I'd make is that the installation instructions were woefully lacking - assumed the hot fix applied via the "Upgrade Wizard", but that threw an error that led me down a rabbit hole that ended with me "discovering" the Module Loader. A one-line "Apply the hot fix with the Module Loader." would have fixed that so quickly and easily...

RE: Action needed - January 4, 2023: SugarCRM Hotfix for critical security vulnerability

Wilfried Pascault — Thu, 05 Jan 2023 16:37:49 GMT

Is there a link between this fix and the 0day file upload vulnerability published on Full Disclosure security list ?
seclists.org/.../31

RE: Action needed - January 4, 2023: SugarCRM Hotfix for critical security vulnerability

Olaf Doernenburg — Thu, 05 Jan 2023 14:13:05 GMT

Hi,

since we got only this message, we are not sure what is meant by

"If you have not yet applied the hotfix released earlier today, you need only download and apply v1.1 Hotfix 91155 XXXX"

Had there been a release which was not announced?

And which security issues are fixed, usually we get a list of the impacts.

Thanks and best regards

Olaf