Skip to content
CVE Tracker
Back

CVE-2017-5219

An issue was discovered in SageCRM 7.x before 7.3 SP3. The Component Manager functionality, provided by SageCRM, permits additional…

Critical9.8EPSS 3.3%
Published
Updated
Reserved
Assigned by
mitre

Description

An issue was discovered in SageCRM 7.x before 7.3 SP3. The Component Manager functionality, provided by SageCRM, permits additional components to be added to the application to enhance provided functionality. This functionality allows a zip file to be uploaded, containing a valid .ecf component file, which will be extracted to the inf directory outside of the webroot. By creating a zip file containing an empty .ecf file, to pass file-validation checks, any other file provided in zip file will be extracted onto the filesystem. In this case, a web shell with the filename '..\WWWRoot\CustomPages\aspshell.asp' was included within the zip file that, when extracted, traversed back out of the inf directory and into the SageCRM webroot. This permitted remote interaction with the underlying filesystem with the highest privilege level, SYSTEM.

Scores

CVSS scores of CVE-2017-5219, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Critical9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
3.3% · top 12% of all CVEs (3 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

  • n/a

    • affected n/a

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2017-5219 badge
[![CVE-2017-5219](https://trackcve.app/badge/CVE-2017-5219.svg)](https://trackcve.app/cve/CVE-2017-5219)

Record last updated .