What is the CVSS score of EUVD-2024-54779?

EUVD-2024-54779 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.9%.

Which versions of Salesforce are affected by EUVD-2024-54779?

SugarCRM contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allowing remote attackers to redirect internal server requests toward cloud metadata endpoints and internal…. A patch is available.

Is there a public PoC exploit available for EUVD-2024-54779?

Yes, a public proof-of-concept exploit is available for EUVD-2024-54779. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2024-54779?

Within 24 hours: Identify all SugarCRM deployments and confirm installed versions (13.x or 14.x). Within 7 days: Apply vendor patch to SugarCRM 13.0.4 or later for 13.x installations, and 14.0.1 or later for 14.x installations. Within 30 days: Conduct audit of SugarCRM API access logs for suspicious outbound requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254). Review any credentials accessible via cloud metadata for compromise indicators.

Salesforce EUVD-2024-54779

| CVE-2024-58258 HIGH

Code Injection (CWE-94)

2025-07-13 cve@mitre.org

SSRF Code Injection Salesforce

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:26 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.0.1,13.0.4

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2024-54779

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Nov 03, 2025 - 20:17 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 22:15 nvd

HIGH 7.2

DescriptionCVE.org

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

AnalysisAI

CVE-2024-58258 is a Server-Side Request Forgery (SSRF) vulnerability in SugarCRM's API module that exploits limited code injection capabilities to allow unauthenticated remote attackers to make arbitrary requests from the affected server. SugarCRM versions before 13.0.4 and 14.x before 14.0.1 are affected, potentially enabling attackers to access internal resources, cloud metadata endpoints, or perform lateral movement. The vulnerability has a CVSS 3.1 score of 7.2 (High) with network-based attack vector and no authentication required, though it does not enable direct code execution or availability impact.

Technical ContextAI

The vulnerability stems from CWE-94 (Improper Control of Generation of Code, aka 'Code Injection') within SugarCRM's API module. The underlying issue involves insufficient input validation or output encoding when processing API requests, allowing attackers to inject limited code constructs that enable SSRF attacks. SugarCRM is a web-based Customer Relationship Management (CRM) platform built on PHP and leveraging REST API interfaces. The affected CPE strings are: cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:* (versions <13.0.4 and 14.0.0). The API module likely processes user-supplied parameters without adequate sanitization before passing them to HTTP client libraries or file operations, enabling attackers to specify arbitrary target URLs or internal resources for the server to request on their behalf.

RemediationAI

{'type': 'Patch', 'version': '13.0.4', 'description': 'Update SugarCRM 13.x installations to version 13.0.4 or later', 'priority': 'Critical'} {'type': 'Patch', 'version': '14.0.1', 'description': 'Update SugarCRM 14.x installations to version 14.0.1 or later', 'priority': 'Critical'} {'type': 'Mitigation', 'description': 'Implement network-level controls to restrict outbound HTTP/HTTPS requests from SugarCRM application servers, particularly blocking access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254 for AWS)', 'priority': 'High'} {'type': 'Mitigation', 'description': 'Apply API rate limiting and request validation at the SugarCRM API gateway level to restrict unusual request patterns', 'priority': 'Medium'} {'type': 'Detection', 'description': 'Monitor API access logs for anomalous requests to internal resources or non-whitelisted external URLs; implement WAF rules to detect code injection patterns in API parameters', 'priority': 'High'}