This is a notification for product news or an alert. If you have a question, please start a new discussion

Just Released in North America: Sage CRM patches addressing vulnerabilities now available for 2021 R2, 2022 R2, 2023 R2

Three Patches for Sage CRM are now available and have been distributed to the Sage Regions.

  • Sage CRM 2021 R2.5
  • Sage CRM 2022 R2.4
  • Sage CRM 2023 R2.2

These patches resolve a few internal issues and provide a new system feature to control of application security. For North America customers these patches can be found in the Sage Knowledgebase in article titled "Sage CRM Hotfix Downloads".


A new checkbox Allow external URLs in website gadgets in the system behavior settings allows system administrators to enable or disable external URLs in the website gadgets.

Allowing external URLs makes Sage CRM less secure, because users can be potentially redirected to a malicious URL.

Note: An Interactive Dashboard Website Gadget will not display website pages configured to prevent pages from being loaded within an iframe on another domain. Using Firefox, the following message may be displayed "To protect your security, <URL> will not allow Firefox to display the page if another site has embedded it. To see this page, you need to open it in a new window." Other browsers will not display a message. This is a server HTTP Response Header setting and not a CRM bug.


  • Apache Solr has been upgraded to version 8.
  • Mitigation has been provided to prevent SQL injection attack within certain fields.
  • A fix has been applied to an error that occurred when a user uploaded a file whose name contained an ampersand (&) to Sage CRM.

The following direct upgrades are supported:

  • 2021 R1 - 2021 R2.5
  • 2021 R2 - 2021 R2.5
  • 2022 R1 - 2022 R2.4
  • 2022 R2 - 2022 R2.4
  • 2023 R1 - 2023 R2.2
  • 2023 R2 - 2023 R2.2

Please note that these patches apply to Sage CRM standalone and when integrated with Sage accounting products Sage 100 and Sage 300.

In all cases, it’s our advice the patches are applied as soon as possible.