CVE-2019-14547
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromising their accounts).
- Affected products
- Espocrm
- Espocrm
- < 5.6.9
- Fix
- Available
- CVSS 3.0
- 5.4 MEDIUM
- EPSS
- 1.1% (62th percentile)
- Weakness
- CWE-79
- NVD status
- Modified
- Published
- 2019-08-05
CVE-2019-14547 at NVD
No indexed exploits for CVE-2019-14547 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2019-14547 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.