{"id":"CVE-2024-58258","aliases":["EUVD-2024-54779","GHSA-828p-92r7-xw6x"],"status":"published","title":"SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited...","description":"SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.2238,"percentile":0.97709,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2025-07-13T00:00:00Z","modified":"2026-06-17T08:14:43Z","exploits":[{"source":"exploitdb","id":"EDB-52365","title":"SugarCRM 14.0.0 - SSRF/Code Injection","type":"webapps","platform":"multiple","date":"2025-07-16","url":"https://www.exploit-db.com/exploits/52365"},{"source":"pocgithub","id":"Web3-Serializer/CVE-2024-58258","title":"Web3-Serializer/CVE-2024-58258","date":"2025-11-21","url":"https://github.com/Web3-Serializer/CVE-2024-58258"}],"products":[{"vendor":"sugarcrm","product":"sugarcrm"}],"references":[{"url":"https://support.sugarcrm.com/resources/security/sugarcrm-sa-2024-059/"},{"url":"http://seclists.org/fulldisclosure/2025/Jul/21"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58258"},{"url":"https://support.sugarcrm.com/resources/security/sugarcrm-sa-2024-059"},{"url":"https://github.com/advisories/GHSA-828p-92r7-xw6x"}],"sources":{"cve":[{"id":"CVE-2024-58258","description":"SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.","status":"published","published":"2025-07-13T00:00:00Z","modified":"2025-11-03T19:34:25.863Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-54779","description":"SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.","status":"published","published":"2025-07-13T00:00:00Z","modified":"2025-11-03T19:34:25Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-828p-92r7-xw6x","title":"SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited...","description":"SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.","status":"published","published":"2025-07-14T00:31:07Z","modified":"2025-11-03T21:35:13Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:04:25.4654Z"}],"nvd":[{"id":"CVE-2024-58258","description":"SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.","status":"published","published":"2025-07-13T22:15:23.09Z","modified":"2026-06-17T08:14:43.66Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}