OSVDB ID: 85111

Title: SugarCRM cache/include/externalAPI.cache.js File Direct Request Path Disclosure

Info

Disclosure

Aug 30, 2012

Discovery

Unknown

Dates

Exploit

Aug 30, 2012

Solution

Aug 24, 2012

Description

SugarCRM contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a direct request is sent for the cache/include/externalAPI.cache.js file, which will disclose the full installation path to a remote attacker.

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified, Third-party Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

Upgrade to version 6.5.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

SugarCRM Inc.

SugarCRM

6.5.2

References

Exploit Database: 20981
Secunia Advisory ID: 50384
Related OSVDB ID: 85068 85078 85079 85080 85081 85112
Other Advisory URL: http://itsecuritysolutions.org/2012-08-30-SugarCRM-Community-Edition-6.5.2-multiple-vulnerabilities/

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/85111